How your data is kept, in mechanisms rather than promises
Every claim below describes something the software does, in a way that a test in our own build holds before anything ships. Where we cannot say something honestly, we say nothing.
What the software does
Workspaces are kept apart in the data layer
Every record belongs to exactly one workspace, and the separation is applied on every read and every write by the data layer itself rather than by each screen remembering to ask. A query that forgot to say which workspace it meant returns nothing; a write that did is refused. The one thing your browser carries is which workspace you last chose, and the server re-checks your membership of it on every request, so changing it selects nothing you are not already in.
These pages run nothing and remember nobody
The marketing pages you are reading load no script, set no cookie and carry no third party at all; the contact form sets one cookie, to protect the form itself, and nothing else. What is counted is how many times a page was opened, on a row that has a date, an address path and a referring site on it and nowhere to put who you are.
Every figure is worked out by the server
On the insight panels the numbers come from your own records, computed by the server from your workspace's data. A model is never asked what a number is, so a figure on a panel is something your records produced rather than something a model said they would have.
A finding carries the page it was read from
When research returns a finding, the address beside it is one the run really retrieved, checked against what the search actually returned rather than taken from the model's own account of itself. An address the model produced from nowhere is dropped, and a run with no web access stores none at all.
Spend you can see
Every AI call is charged against a balance you can see, itemised by what it was spent on, in your own workspace rather than on a statement a month later. A call you stop half way is still charged, because you still paid for the part that ran.
Your account is yours to take and to close
You can download the personal data held about your account and delete the account yourself, from your own account pages, without writing to anybody and without waiting for us, unless you are the only Owner of a workspace other people are in, in which case you hand that over first, or you hold a subscription that will renew, in which case you cancel it on your billing page first and can delete as soon as the cancellation is scheduled.
Everything above is a property of the software itself. Nothing on this page is a claim about an outside review we have been through: that would be a fact about the company rather than about the code, and it is not ours to write here.