Security

Every customer's data lives in the same database but is isolated by row-level security policies enforced at the database itself, not just in application code. A request from one workspace cannot read or write another workspace's conversations, contacts, or settings, and this is verified by an automated cross-tenant isolation test suite that runs on every change to the codebase.

All traffic to and from SetMore AI is encrypted in transit (TLS). Calendar integration tokens are encrypted at rest, so a database copy alone is not enough to access a connected calendar.

Internal service paths that bypass per-request permission checks are limited to a small, enumerated set of operations, such as processing a billing webhook, rather than being available broadly across the codebase.

Our logs are built to carry identifiers, such as an account or message id, and not the content of a conversation or a phone number, so that debugging never requires reading what a lead actually said.

Card numbers are handled entirely by Stripe. We never see or store your card number.

We do not hold a SOC 2 report or similar third-party certification yet. If your organization requires one before signing up, contact us and we will let you know where we stand.

If you find a security issue, email team@setmore.ai with details and, if possible, steps to reproduce it. We will acknowledge the report and follow up as we investigate.

You can request a full export of your workspace's data, or its deletion, at any time. See our Privacy policy for how that works and how long it takes.