Every conversation belongs to a membership at one club. No query shape reaches another club's rows, and no club can learn which other clubs a member belongs to. Enforced by tests that fail the build.
No self-service signup anywhere. Nobody holds a password — members, your staff and our own team all prove a mailbox: a six-digit code, ten minutes, one use, bound to the browser that asked. Removing a staff assignment revokes their sessions at once.
Grounded in your knowledge only; everything it reads is fenced from its instructions. It writes nothing into any club system today. No model is trained on your data. It hands off to your staff rather than guessing.
No passwords, no payment details, no member email or phone sent to the model. Append-only audit on every staff and operator action. Conversations age out 12 months after a membership ends.
Named people on our own team, read-only, audited. Dedicated infrastructure — your own database and keys — is available on request where a review requires it.
Review: the application is reviewed end to end against an attacker's goals
rather than a checklist, and what it finds is remediated before the review closes. Last
completed September 2026; we will walk your security
team through it under NDA.
Subprocessors:
DigitalOcean, Anthropic, MailerSend, Google, and GitHub, and thirty days' notice
before we add one. No advertising, no third-party tracking, no data brokers.
Backup keys: the queue replica and the nightly copy of your documents are
encrypted on our host, under keys we hold, before anything leaves it. The managed database
and the object storage holding uploads are encrypted at rest by DigitalOcean under its keys
— the same arrangement for handbooks as for transcripts.
Retention:
conversations 12 months, roster record, profile, preferences, push subscriptions, the team's working note 30 days, the working note we write about a member for your team 90 days, a member who asks to be deleted 7 days, inbound newsletter, raw 1 day, uploads archives offsite 30 days, document links 6 days, and audit events 7 years.
Breach notice: to the club within
72 hours of confirmation, as a term of service.