Encryption
Every connection to this website, the app and our APIs uses HTTPS with TLS 1.2 or newer; older protocols are refused. Our website and the app also tell browsers to connect over HTTPS only (HTTP Strict Transport Security).
Supabase (the database and uploaded files), Vercel (hosting), Stripe (payments) and Google Workspace (email) encrypt the data they store for us.
Separate workspaces
Each customer account is its own workspace. The database itself decides what a signed-in person can read or change, using row-level security: a member of one workspace cannot reach another workspace's data, and a request without a valid sign-in gets none.
Uploaded files are kept in private storage, never on public links.
Our staff look at Customer Data only when needed to deliver the app, to fix a problem, to build a Custom Flow, or when you ask us to.
Signing in
- Staff tools are open only to accounts on our own company domain.
- Passwords are stored by our sign-in provider in scrambled (hashed) form. We cannot see your password.
- When a Flow opens another website inside the app, you sign in to that site yourself and the session stays on your device. We never ask for, receive or store that password, and we never ask for MLS logins.
If you think someone has used your account without permission, email us at once.
Payments
Payments go through Stripe. Compute plans are paid on Stripe's hosted checkout page. Invoices, including development fees, are paid in Stripe's card form, which Stripe loads inside the app. Either way your card number goes straight to Stripe and never reaches our servers. We receive only the card brand, last four digits, expiry date, billing name and address, and records of charges and invoices.
Signed agreements
When you accept our Terms of Service, Privacy Policy and Data Protection and Confidentiality Addendum, or sign a quote in the app, we record who signed, the date and time, the document version and a fingerprint of its text (a SHA-256 hash), with your IP address. The fingerprint shows later that the text was not changed after signing.
We keep signed agreements and their signature records for 7 years after an account closes, or longer if the law requires.
Companies we use
We share personal information only with these companies (our subprocessors), which process it for us to deliver the app. This is the same list as Section 9 of our Privacy Policy.
| Subprocessor | What it does for us |
|---|---|
| Anthropic | AI processing for Flow Runs |
| Supabase | Database, sign-in, file storage and server functions. Our database and files are stored in its US East (Ohio) region, in the United States. |
| Vercel | Hosting the website |
| Stripe | Payments and invoices |
| Google Workspace | Email and calendar |
| Zoom | Discovery calls |
| Fathom | Call recording and transcription |
We do not train AI models on Customer Data. Anthropic processes it under its commercial terms, which do not permit it to train its models on that data.
We give customers 30 days' notice before a new subprocessor starts processing their data.
If there is a breach
If we confirm a security breach that affects your data, we will tell you within 72 hours of confirming it. We will say what happened, which data and people are affected as far as we know, what we have done, and who to contact. We will keep you updated as we learn more, and help you with any notices you need to send.
Copies and deletion
- You can ask us by email for a copy of the personal information we hold about you.
- The account Owner can also export the account's data from the app at any time.
- You can ask us to delete your personal information by email. We delete it, except records we must keep, such as billing, tax and payment records and signed agreements (kept for 7 years after the account closes).
- When an account closes, we delete its Customer Data and Outputs, including uploaded files, within 30 days. Deleted data can remain in backups until they roll off, within 35 days.
Report a security issue
If you find a security problem in our website or the app, email hello@saltandleafsystems.com with "Security" in the subject. Tell us what you found, where, and the steps to reproduce it.
Please don't access, change or delete other people's data, and don't run tests that slow the service down. Give us a reasonable chance to fix the problem before you share details. We will confirm we received your report and keep you posted while we fix it.
Our contact details for security researchers are also at /.well-known/security.txt.