Designed to comply strictly with Google API Services, Meta Data Privacy, and Australian/UK Privacy Principles.
PILLAR 01
Strict adherence to the Google API Limited Use policy. OAuth 2.0 token scopes are sandboxed and used exclusively for your business actions. We read inbox metadata strictly for 08:00 AM daily briefings. Email content is never sold or shared.
PILLAR 02
Strict adherence to Meta Developer requirements. Meta Cloud API tokens granted for WhatsApp messaging and social posting are encrypted via hardware-level Secure Enclave keypairs, and used solely to dispatch authorized posts and review replies after 1-tap sign-off.
PILLAR 03
All organizational data is stored on an enterprise Supabase Row-Level Security (RLS) PostgreSQL database. Every query requires authenticated user JWT tokens, ensuring strict tenant isolation.
PILLAR 04
Your financial invoices and client data are NEVER used to train public LLM models. Enterprise zero-retention API contracts enforce complete data isolation.
No Co-Worker can send an email or publish a post without passing Layer 1 compliance checks and receiving your explicit 1-tap WhatsApp approval.
LAYER 1
Every draft is screened against compliance rules and the Co-Worker's safety guardrails before anything else happens.
LAYER 2
A second audit pass verifies the output. Flagged tasks trigger a fail-safe automatic pause.
LAYER 3
Only your explicit [ APPROVE ] on WhatsApp executes the action. Full audit log of all WhatsApp approvals.
Last Updated: October 2026 • Compliant with APP 1988, GDPR & CCPA
Questions about data handling? Email privacy@xpressai.com.
