This is the long technical version of our Security & Privacy page - written for security teams running a vendor review. It describes what runs today.
How a Pocodot request is processed
Every request from your channel (Slack, WhatsApp, email, web) hits a TLS-terminating proxy, then our API. The first thing our API does is identify which workspace the request belongs to, using a session token bound to that workspace. From that moment on, database queries and tool calls run against that workspace.
Per-workspace data isolation
Every table that holds tenant data carries a workspace_id. API endpoints check the workspace against the session token, and a request that names a different workspace from the one bound to its session is refused. We have an automated test suite that issues cross-workspace requests and checks they are refused; those tests must pass before any code change ships.
Cryptography model
All traffic between you and Pocodot travels over TLS. Integration credentials (Slack tokens, OAuth refresh tokens and similar) are encrypted at the column level with AES-256-GCM. The encryption key is held in environment configuration on the production host with restricted access.
Logins saved in Cole's Vault get a second, stronger model. Each one is encrypted with AES-256-GCM using a key unique to your workspace, derived with HKDF-SHA256 from a master key that lives only in the host's root-owned configuration, never in the database. The AI model never sees a saved secret: Cole's browser fills it in directly, only on the website it is scoped to, and every use is logged. Deleting a saved login deletes the row.
Other workspace data (messages, notes, tasks, memories) is stored in our Postgres database on our own servers, reachable only from those servers, without a separate encryption layer. Daily database backups are kept for 14 days and then removed.
Authentication and session model
Sessions are bound to a single workspace when they are created. If that workspace is archived, the session has to verify again before it can do anything.
Logging and observability
We keep a server-side log of API requests. Credential fields (tokens, passwords, API keys and similar) are redacted before anything is written. Operational logs are kept for 14 days.
Sub-processors and AI provider terms
Our AI providers (Anthropic, OpenAI, Google Gemini) are contracted under enterprise no-train terms - your message content is never used to train AI models. Our integration partner (Composio) may use anonymized operational metadata for product improvement, but never message content. The current sub-processor list is available at /security/subprocessors.json.
Incident response
If a security incident affects your workspace, we notify your workspace admins within 72 hours of confirming it, in line with GDPR Article 33.
Deletion
Only the workspace owner can delete a workspace. Deletion removes the account and its data from our live database for real, across every table that holds it, in one transaction. Daily backups that still contain the data are removed as they pass the 14-day retention window.
Compliance posture
We are GDPR-aligned today and can sign a Data Processing Agreement at the start of any contract. For SOC 2 and HIPAA questions, email security@pocodot.ai and we will tell you exactly where things stand.
Security teams running a review: email security@pocodot.ai with your questions.