How we keep your company private.

The wall between companies

Every record in Operating System belongs to exactly one company. The database itself checks every read and every change against who you are and what your company lets you do. The screens only show what the database has already allowed; nothing is kept private by hiding it.

Records can't be moved from one company to another, and nothing in one company can point at something in another. Automated tests check this on every change we make: two companies, where each tries to see, change or reach the other's records in every table and through every function.

Our team's access

While we build your OS, our builders have a temporary seat in it. When you accept the handover, every builder seat is removed in the same step, and the OS is yours.

After that, our team can open your OS only when an owner or admin gives access:

• to one named person, view only or view and fix;
• for a set time, from one hour to fourteen days;
• with or without finance and confidential records, as you choose;
• and only while that person has a session open, which ends after 12 hours.

Opening and ending a session is written into your audit log and shown on your Access page. Support can never approve, send or publish anything, delete records or the company, invite people, change roles, give itself more access, or read your keys. You can withdraw access at any time.

Your keys

If you connect your own email-sending or Claude account, its key is stored in the database's encrypted vault. The app keeps only whether a key is stored and its last four characters. Only the server reads it, for your company, after checking that the person asking may use it. It is never sent to a browser and never included in an export.

The AI

The AI Chief of Staff answers from your records with the permissions of the person asking, so it sees only what they can see. Confidential record types reach it as counts, never their contents. Each claim it makes is marked as recorded, an assumption or a recommendation.

It prepares work and never acts on its own: drafts wait for a person's approval, and it never sends, posts or changes anything. If you connect your own Claude key, the AI runs on your account; otherwise on ours. Either way, the AI provider receives the context needed to answer.

The AI sales team

The AI sales team works for one company, inside that company's OS. It researches from public sources, such as news, company websites, careers pages and public tender notices, and from the tools you connect. It never collects private LinkedIn data, never works around a platform's rules and never uses bought or scraped lists.

Every company and person it adds carries its source. A contact detail is marked verified only once it has been checked, and until then it says so. Your suppression list applies to every message.

Every email it writes is a draft until a person approves it. Approved emails go out through your own email account, from your own domain, one approved message at a time, so your email provider's rules apply. Connecting an account never turns on bulk sending.

The morning email is put together separately for each person who receives it, with that person's permissions, so it never shows them anything they couldn't see in the OS.

The audit log

The database records every addition, change and deletion, plus approvals, sends, exports and support sessions. Each entry says who did it: a person, the AI, a routine, an integration, our support team or a builder. It records which fields changed, not personal values. Nobody can edit or delete an entry.

Your data is yours

Owners and admins can download a full copy of their company's OS at any time. Only an owner can delete it, after typing its name. Deleting removes everything, including the audit log; our own records keep a single line saying it was deleted.

The limits, stated plainly

• Operating System runs on Lovable Cloud, which is built on Supabase. Like any hosted service, the hosting providers and whoever administers the database can technically reach the data. We keep database administration to our operator, use it only to build and maintain the system, and never use it to read your records.
• The AI provider sees what the AI is given. If you'd rather none of your data reached our AI account, connect your own Claude key or leave the AI features unused.
• Signing in needs an email address that has been confirmed, or a Google account. Invitations only work for the address they were sent to.

Questions about any of this? Ask us.