Your revenue data is the most sensitive you hold. We build accordingly.

• Encryption. Your data is encrypted in transit (TLS 1.2+) and at rest. The connection credentials that link your CRM, calendar, and conversation tools are additionally sealed with application-layer envelope encryption (AES-256-GCM) on top of full-disk encryption.
• Hosting. The Service runs in the United States on Vercel and Supabase.
• Tenant isolation. Your workspace's data is isolated at the application layer and backstopped at the database with default-deny row-level security, so a single missed filter can't expose another customer's data.
• No training on customer data. We do not use Customer Data, prompts, or AI Output to train, fine-tune, or improve any AI model, including our own. That commitment is in our Terms (Section 4.2), and every AI provider we use runs on API terms that prohibit training on your content.
• Read-only to your CRM. Management OS never creates, changes or deletes a CRM record. It writes only where you deliver your work: briefs and alerts to the Slack channels or Notion page you choose, a Doc you export to Google Drive, and the webhook it registers with a tool you connect so new records reach it.
• Default-deny access with MFA. Authentication is handled by Clerk with multi-factor support; everything that isn't explicitly public requires authentication.
• Scrubbed telemetry. Our product analytics and error monitoring are scrubbed of prompts, PII, and customer content before anything leaves the app; workspace identifiers are hashed.
• Verified integrations. Every integration is least-privilege and revocable, and every inbound webhook is cryptographically verified.
• Audit trail & abuse limits. Security-relevant actions — credential changes, admin actions, token issuance and revocation — are written to an append-only audit log, and our AI endpoints are rate-limited per workspace to contain abuse.
• Hardened by design. Server-side content fetches are protected against server-side request forgery, untrusted content is isolated before it reaches a model to guard against prompt injection, and the app ships with a modern security-header baseline (HSTS, CSP, anti-framing).

Data enters only from sources you connect. It is stored, encrypted, in our US database, processed to generate your briefs and answers, and delivered to you by email, Slack, WhatsApp, or the app. You can disconnect any source, and request export or deletion, at any time.

Sources you connect (CRM · calendar · conversations · files)  →  Encrypted storage (US)  →  Generation (no training on your data)  →  Delivery to you (brief · alert · answer)

Retention, your rights, and the legal bases for each use are detailed in the Privacy Policy.

Generation and embeddings run on enterprise AI providers (Anthropic and OpenAI). Voice runs on two speech providers. Deepgram turns speech into text for WhatsApp voice notes and the in-app microphone. ElevenLabs speaks replies back, and it hosts the live voice agent for WhatsApp calls: Twilio carries the call from WhatsApp to ElevenLabs, which handles speech recognition, the conversation and the spoken reply, calls Anthropic's Claude as the agent's model, and looks up your workspace data in Management OS for the duration of the call. We do not use your data to train models, and none of these providers uses your prompts, audio, or the AI's responses to train theirs. All are configured on API-tier terms that prohibit training on Customer content.

Under each provider's published policy, prompt inputs and generated outputs are retained by the provider for up to 30 days for safety and abuse-monitoring purposes and then auto-deleted. Narrow carve-outs apply where content is under a Customer's own control on services the Customer manages, where legal requirements compel longer retention, or where the provider's Usage Policy enforcement requires it. Provider details, source links, DPAs, and certifications are on the sub-processor list.

We apply attribution and identity-boundary filters to AI output so generated artifacts stay in your company's voice and don't leak content across contexts. AI output is probabilistic and meant to inform your judgment, not replace it — consequential decisions keep a human in the loop.

You can use Management OS from AI assistants through our MCP server. You sign in with your Management OS account; the assistant receives an access token limited to your workspace and seat, never your password. Every tool is read-only: nothing sends messages, changes CRM records or deletes data.

We receive only what the assistant sends in a tool call, never your conversation history. Evidence is used for that request and not stored; we keep a one-way fingerprint, and the result for up to 24 hours so a retried request gets the same answer. The assistant's provider handles your conversation under its own terms. Details are in the AI assistants guide and Section 12.4 of the Privacy Policy.

Access is default-deny: every non-public route requires authentication, and permission checks are enforced again at the handler, not just at the edge. Multi-factor authentication is supported. Enterprise single sign-on (SAML) is scoped per customer through our authentication provider, Clerk; email us to discuss it.

You choose what to connect, and you can disconnect at any time.Read-only to your CRM. Management OS never creates, changes or deletes a CRM record. Each integration guide documents exactly what we read, what we write (for most tools, nothing), why each permission was requested, and how to revoke from both sides. See the integration guides and the current sub-processor list.

Our privacy program covers the EU GDPR, UK GDPR, and US state privacy laws, with defined legal bases, a retention schedule, and data-subject rights. Our Data Processing Addendum (with the EU Standard Contractual Clauses and UK Addendum) and Acceptable Use Policy are published, and the DPA applies automatically when you accept the Terms. Full detail is in the Privacy Policy.

Status as of October 15, 2026:

• SOC 2. SOC 2 Type I is targeted for Q4 2026. We hold no SOC 2 report today.
• Penetration testing. An independent penetration test is planned. None has been performed yet, and we will say so until one has.

We'll publish progress here and share artifacts under NDA as they land. We'd rather tell you exactly where we are than imply more than is true.

• Breach notification. Without undue delay, and no later than 72 hours after we become aware of a personal data breach affecting your data (DPA Section 9).
• Sub-processor changes. 30 days' notice before a new sub-processor touches personal data, with a right to object (DPA Section 6).
• Deletion. Active data deleted within 30 days of termination; encrypted backups roll off within 90 days (DPA Section 12).
• Questionnaires. We answer SIG Lite, CAIQ or your own questionnaire, and your follow-up questions in writing.

Email security@mgmt-os.ai with “Security review” in the subject.

• Terms of Service
• Privacy Policy
• Data Processing Addendum
• Acceptable Use Policy
• Sub-processors
• Transparency report
• System status
• Vulnerability disclosure policy

September 2026. Identified and closed a build-configuration issue that made client-side JavaScript source maps publicly retrievable. No customer data, credentials, or database access were affected. Added build-time and post-deploy controls that block any future source-map exposure automatically.

If you believe you've found a security issue, please email security@mgmt-os.ai. We investigate every report and will acknowledge yours. Full details, including our safe-harbor commitment, are in our vulnerability-disclosure policy, and our machine-readable contact is at /.well-known/security.txt.

Security: security@mgmt-os.ai
Privacy & data: privacy@mgmt-os.ai