We respect your privacy
We use cookies to keep you logged in and understand how you use Pocodot. You can customize your preferences or accept all. Cookie Policy
Security & Privacy
Pocodot reads your messages, runs your tasks, and holds the keys to your tools. That's a lot of trust. Here's exactly what we do to deserve it.
Each one is something we do today, or something we're rolling out within weeks. Where we're not all the way there yet, we say so.
Our AI processes your messages so it can reply. No human at Pocodot reads them as a normal part of our work.
Everything you do, say or store is tagged with your workspace, and every request is checked against that tag before it touches anything.
Every service that offers an official login (Slack, Google, Notion) is connected through it, and we never see those passwords. Logins you choose to store in Cole's Vault are encrypted with a key specific to your workspace, used only to sign in on that site, optionally with your approval every time, and you can delete them at any time.
Your conversations are never used to train AI - not ours, not OpenAI's, not Google's. We have signed contracts that prohibit it.
When you delete your workspace, we permanently delete your account and its data from Cole. Our daily backups age out after 14 days.
Enterprise customers can ask for their own private Pocodot, with its own database and server. Nobody else shares it.
Plain answers, no hedging.
No. Every piece of data we store is tagged with your workspace. Every part of our system checks that tag before answering any question. We have automated tests that try to break this rule - they have to pass before any code change ships.
No. The AI providers we use (Anthropic, OpenAI, Google) are contractually forbidden from training on your data. Our integration partner (Composio) may use anonymized usage statistics - never your message content. The full breakdown is on our Sub-processor page.
Then we tell you within 72 hours. We'll explain what happened, what was affected, and what to do. We follow GDPR Article 33 to the letter. Our incident plan covers detection, containment, customer notice, and a public post-mortem afterward - so the same mistake can't happen twice.
Your account and its data are permanently deleted from Cole, and our daily backups age out after 14 days. Want a copy first? Ask through the data request form on our GDPR page.
Using Cole in a WhatsApp, LINE or Telegram group? See what Cole sees, keeps and uses in a group chat.
Plain access controls. You're always in charge of who has the keys.
Your password is never stored as text.
One click, no password to remember.
We email you a one-time link.
An extra code from your phone, every time you sign in.
For teams using Okta, Microsoft, Google Workspace, or OneLogin.
The companies that help us run Pocodot. We give 30 days' notice before adding any new one.
No spin. Just where we are.
Live status is published.
SOC 2 Type II is in progress. We do not hold a report yet, and we will publish it the moment we have it.
Email privacy@pocodot.ai or grab the template from our trust portal.
Talk to us if you need it sooner.
Twenty answers in plain English. Each one is yes-or-no first, then the why.
On secure servers in Singapore today. Enterprise customers can choose the United States, Europe, or Asia-Pacific.
Pocodot's AI processes your messages so it can reply - that's its job. No human at Pocodot reads your messages as part of normal work. A small group of engineers can look at logs during a support investigation.
No. Never. It's written into our privacy policy and our customer contracts.
No. Our AI providers (Anthropic, OpenAI, Google) are contractually forbidden from training on your data. Our integrations partner (Composio) only sees anonymized usage patterns - never message content.
Here is exactly how. Everything travels over encrypted connections. Saved logins, connected-app tokens and API keys are also encrypted where we store them. Your messages and notes sit in our database, reachable only from our own servers, without a separate encryption layer, because Cole has to read them to do its job.
For the most sensitive things, yes. Logins saved in Cole's Vault are encrypted with a key unique to your workspace. Everything else is kept apart by your workspace tag, which every request is checked against.
We're not end-to-end encrypted, and we won't pretend to be. Pocodot is an AI assistant - it has to read and act on your messages to do its job. We protect your data in other ways (encrypted connections, encrypted logins and tokens, workspace checks on every request), but our system does see the message content while it's working.
Yes. Ask through the data request form on our GDPR page, or email privacy@pocodot.ai, and we will send you a copy of everything Pocodot holds about you.
Yes. Click "Delete my workspace" in your settings. It permanently deletes your account and its data from Cole, and our daily backups age out after 14 days.
Owners and admins decide who is in your workspace, with owner, admin and member roles, and can remove anyone at any time.
Yes - rolling out shortly. You'll be able to require an extra one-time code (from an authenticator app or a security key) for every sign-in.
Yes - rolling out for Enterprise customers. Single sign-on with SAML 2.0 and automatic user provisioning (SCIM).
Not yet - and we won't pretend otherwise. SOC 2 is in progress, and we will publish the report the moment we have it. Until then, email security@pocodot.ai and we will answer your security questions directly.
Yes. We can sign a Data Processing Agreement with you in minutes. Email privacy@pocodot.ai or grab the template from our trust portal.
HIPAA is coming with our Enterprise plan. Healthcare prospects: talk to us so we can sequence your timeline.
Our security architecture page is the long technical version of everything here. For documents such as our DPA, use the request form on our trust page or email security@pocodot.ai.
We tell affected customers within 72 hours, in line with GDPR Article 33. We explain what happened, what was affected, and what to do.
Your data isn't held hostage. You can ask for a copy of everything at any time. If we ever shut down, we'll give you 90 days' notice and the tools to take your data with you.
Email security@pocodot.ai. Include what you found and how to reproduce it. We credit responsible reporters in our release notes (with their permission).
Every connection uses Slack's official login. Tap any item to see why we ask, and how to revoke it in one click.
channels:readWhy we need it: So Cole can find the right channel when you ask 'post this to #marketing'.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
channels:joinWhy we need it: So Cole can automatically join public channels and learn your team's context without manual invites.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
chat:writeWhy we need it: So Cole can reply, post summaries, and send the messages you ask for.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
im:historyWhy we need it: So Cole can carry on a conversation with you, not start fresh on every message.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
users:readWhy we need it: So Cole can route 'send this to Sara' to the right teammate.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
files:readWhy we need it: So Cole can summarise the deck or PDF you just dropped in the chat.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
We've answered most questions on this page. For the rest, talk to us. Most replies within one business day.
Bring an AI coworker into the channels your team already uses.