We don't look at your data. Here are the specifics.

Your data is encrypted at rest using AES-256. It is encrypted in transit using TLS 1.2+. There is no unencrypted path between your application and our servers.

Sensitive fields — payment tokens, personal identifiers, credentials — receive an additional layer of application-level encryption before they reach the database. The database stores ciphertext. A database dump is useless without the keys.

Encryption keys are managed by CryptAply, our key governance layer. Keys are stored in Azure Key Vault (HSM-backed), rotated on policy, and audited on every access. No engineer has a key on their laptop. No key is hardcoded in source.

On our Enterprise tier with CryptAply integration, you bring your own encryption keys or manage the key lifecycle through your own Azure Key Vault or HSM. We hold ciphertext. You hold the keys. If you revoke our access to your keys, we physically cannot read your data. Not "won't" — cannot.

This is the same architecture banks use to protect financial data. We built it because we are a PCI-compliant payment platform. We offer it to you because you deserve the same protection for your business data.

Production databases are not accessible to engineers, product managers, salespeople, executives, or anyone outside the operations team. There is no "admin panel" where an employee can browse your data.

Operations staff access production systems only for infrastructure maintenance: deployments, scaling, incident response, and backup verification. Every access is logged with who, when, what, and why. Those logs are append-only and cannot be modified or deleted.

We do not have a "look at customer data" workflow. It does not exist. If an engineer needs to debug an issue, they work with anonymized data or reproduce it in a non-production environment.

Your database schemas, your records, your agent mail messages, your documents, your API requests — none of it is used to train, fine-tune, or evaluate any AI model. Not ours. Not a third party's. Not ever.

When you use AI features (like schema design), your prompts go to the AI provider you chose with your own API key. We route the request. We do not store the prompt. We do not store the response. We do not log the content. The AI provider's data policy applies to the AI call — ours applies to everything else.

We will never change this without telling you first and giving you the option to leave with your data.

Agent Mail stores messages between your AI agents. Those messages may contain code, specs, business logic, proprietary ideas, and competitive intelligence. We know that.

Message content is stored in your tenant's isolated data partition. It is not indexed for search by anyone outside your tenant. It is not read by our systems for any purpose other than delivering it to the intended recipient. It is not available to our staff.

On Enterprise, message content is encrypted with CryptAply before storage. Even in an internal breach scenario, message content is ciphertext without your keys.

Every customer's data is scoped to their tenant via cryptographic client identity. This is not row-level filtering with a WHERE clause that an engineer could remove. The authentication layer determines which tenant you are before your request reaches the database. The database query is scoped before it executes.

There is no API call, no admin endpoint, no backdoor that returns data across tenants. Cross-tenant data access is not a feature we restrict — it is a feature that does not exist in the codebase.

When you delete your account, we delete your data. Not "mark as inactive." Not "archive for 7 years." Delete.

For encrypted data, we perform cryptographic deletion — the encryption keys are destroyed, making the ciphertext permanently unreadable even if the storage medium is later compromised.

Backups are encrypted and expire on their retention schedule. We do not maintain indefinite backups of deleted accounts.

The infrastructure that enforces these policies is open source under the MIT license on GitHub. You can read the encryption layer (CryptAply), the audit logging (vibesql-audit), the vault (vibesql-vault), the tenant isolation (Vibe.Edge), and the data layer (VibeSQL Server).

We do not ask you to trust a policy document. We ask you to read the code. If our code does not match our policy, file an issue. We will fix the code, not the policy.

github.com/PayEz-Net — 16 public repositories, MIT licensed.