# Security and your data: what is true today | EmpireOS > How EmpireOS separates one company's data from another's, what we are not certified for, and how to get your data back or deleted. URL: https://www.empireos-inc.com/security Markdown: https://www.empireos-inc.com/security.md (every page on this site is served as Markdown the same way: add .md to its address) Updated: 2026-08-21 --- Security and data # What is true today, including what is not. EmpireOS holds a sales organization's pipeline, its recorded calls and its customer conversations. That is data worth asking hard questions about before you put any of it in, so this page answers those questions in the order a security review asks them, and starts with the part most vendors leave you to discover. [Talk to us](https://www.empireos-inc.com/talk) [Read the Privacy Policy](https://www.empireos-inc.com/privacy) First, the part we will not bury ## Three things EmpireOS is not. If any of these is a hard requirement for your team right now, you find it out here rather than on the fourth call. ### Not SOC 2 Type II certified That audit has not been done. EmpireOS is an early-stage company and will not imply otherwise, put a badge on this page, or describe itself as "SOC 2 ready" as though the two were the same sentence. If a certification is a hard requirement for you today, say so on the [Talk to us](https://www.empireos-inc.com/talk) form and you will get a straight answer about where we are. ### No named customers to call The Founding Partner program is twenty companies and is still open. When a customer is willing to be named and quoted, they will be named and quoted. Until then there is no logo row anywhere on this site, because there are no logos, and a borrowed one is worse than an empty space. ### No status page or uptime figure There is not enough monitoring history to publish a number that would mean anything, and a status page with nothing behind it is a worse promise than no status page at all. When there is one it will be linked from here and from the footer of every page. What is true ## How one company's data is kept from another's. Three things that hold today, on the running product, rather than on a roadmap. The question a review asks next, whether the AI can email a customer on its own, is answered below, in the same words we answer it in on a call. ### Isolation is in the database, not in the code Every organization's rows are separated by the database itself rather than by application code that has to remember to filter on every single query. The difference matters because the second kind fails silently the first time somebody writes a query and forgets. Ask for a record you are not entitled to and the answer is that it does not exist, not that it exists and you are denied. ### Every change has a name on it Deals, accounts and contacts each carry a change history: the field, the value before, the value after, when it happened, and whether a person or the AI did it. Nothing to switch on and nothing to configure. Those rows are append-only and the database itself refuses to rewrite them, which is a control we run rather than one you can audit, so we describe it as what it is. ### In transit, measured rather than claimed Both the marketing site and the application negotiate TLS 1.3 with TLS_AES_128_GCM_SHA256, refuse TLS 1.0 and 1.1 outright, and send Strict-Transport-Security with a two-year age, so a browser will not try the insecure version again. Those are handshake results against the live hosts on 19 August 2026, not a vendor's page quoted back at you. At rest, the database and its backups are encrypted by the managed Postgres provider named in the list below; we do not restate a cipher for that here, because we have not measured it ourselves. Who else touches it ## The subprocessors, all of them. Every third party the running product sends data to, what it does, and what it can see. Read off the production configuration, not off a diagram, and current as of 3 September 2026. A vendor that appears in our source code but is not switched on in production is deliberately not listed, because it is not running. Subprocessor | What it does for us | What it can see Vercel | Application and website hosting | Serves every page and every API request, and keeps the request logs. Supabase | The database, sign-in and file storage | The workspace itself: deals, accounts, contacts, activities, recordings and the people in it. Hosted on AWS in us-west-2 (Oregon). Upstash | Cache, rate limits and the job queue | Counters and cached results, and the contents of a background job while it waits to run. Railway | The background worker tier | Runs the queued jobs, so it sees a job's contents while that job is running. OpenAI | Most of the models behind the AI features | The text a feature is asked to summarize, draft, extract from or score, and the answer it returns. Anthropic | Models for part of the AI work | The same kind of text as above, for the features routed to it. Resend | Transactional and notification email | The address and the contents of email the product sends, including sign-in email. Stripe | Payments and subscriptions | Billing details and invoices. Card numbers go to Stripe directly and never reach EmpireOS. Sentry | Error and performance monitoring | Stack traces and the request context around a failure. Apollo | Contact discovery and company enrichment | The company or person being looked up, and only when someone uses that feature. ### Only if you connect them These are not in the path until an administrator switches them on, and then data moves at your direction: Google Workspace, Zoom, Salesforce, HubSpot, your existing conversation intelligence tool. Disconnecting one stops the flow. ### What changes when this list changes This page is the list. If a subprocessor is added or removed the row changes here and the change is dated in [What's new](https://www.empireos-inc.com/changelog), so there is one place to check rather than a document to request. ### What we do not have No SOC 2 report, no ISO certification, no penetration test on file. Those are stated plainly above rather than implied away, and a questionnaire sent through [Talk to us](https://www.empireos-inc.com/talk) gets the same answer in writing. ## The questions a review actually asks Lifted word for word from the [frequently asked questions](https://www.empireos-inc.com/faq), by the build, so there is one answer rather than a careful one here and a plain one there. Q: Are you SOC 2 Type II certified? No, and we are not going to imply otherwise. We are an early-stage company and that audit has not been done. What is true today: every organization's data is isolated at the database level rather than by application code that could forget to filter; your data is used to serve you; anything that leaves a workspace to inform cross-customer benchmarks is aggregate only; and you can export or ask us to delete what we hold. If a certification is a hard requirement for you right now, say so on the [Talk to us](https://www.empireos-inc.com/talk) form and we will tell you honestly where we are. Q: Is my data used to train models for other customers? No model is trained, fine-tuned or improved on your data. Every model call is inference: the text goes to the provider over their API, the answer comes back, and nothing is kept to train anything. The providers' own commercial and API terms say the same about their side, and every one of them is [named on the security page](https://www.empireos-inc.com/security). What crosses a workspace boundary to inform a cross-customer benchmark is aggregate only, never a record, a name or a transcript. Q: What happens to my data if I leave? It is yours. You can export it, and we delete or de-identify what we hold when you ask. That is written into the [Privacy Policy](https://www.empireos-inc.com/privacy) rather than only promised here. Q: Will it email my customers by itself? No, and this is a rule the product is built on rather than a setting you can switch off. The AI drafts, proposes and prepares. A person approves anything that reaches a customer or cannot be undone. Approvals, dismissals and takeovers are recorded, so when someone asks why a customer received a particular email, the answer exists. Q: Will you sign our MSA? We will read it and talk about it like adults. What we will not do is agree to unlimited liability or an SLA we have no way to stand behind at this stage, because signing something we cannot honor is worse than saying no. Send it through [Talk to us](https://www.empireos-inc.com/talk). Q: Is the demo workspace real data? It is a real dataset in a real workspace, and it is not a customer's. It holds 40 open deals, roughly $5.6M of open pipeline and 330+ closed deals with recorded outcomes, which is what the intelligence needs in order to have anything true to say. Nothing you click in there touches a customer. Paperwork and people ## What to send, and where it lands. ### A security questionnaire Send it through [Talk to us](https://www.empireos-inc.com/talk). It is answered by the founder, out of this page and the [Privacy Policy](https://www.empireos-inc.com/privacy), and where the honest answer is "not yet" it will say that in those words rather than in longer ones. ### A processing agreement, or your own contract Also [Talk to us](https://www.empireos-inc.com/talk). The [Terms of Service](https://www.empireos-inc.com/terms) are published in full and in plain language, so you can read the standard position before deciding whether you need to change any of it. ### A security problem you have found Email hello@empireos-inc.com with "security" in the subject line so it is not read as a sales note. We would far rather hear it from you than from a customer, and nobody here will argue with you about whether it counts. See it before you decide ## None of this has to be taken on trust. The workspace in the live demo is a real dataset in the running product and it is not a customer's. Open it, click anything, and watch what the software does with a pipeline before you hand it yours. [Open the live demo](https://app.empireos-inc.com/api/tour/start?chapter=morning&src=site-security) [Start free trial](https://www.empireos-inc.com/signup) [Talk to us](https://www.empireos-inc.com/talk) --- The whole site as one file: https://www.empireos-inc.com/llms-full.txt ยท The facts as data: https://www.empireos-inc.com/empireos.json