How we keep your data and your customers safe

Builds run in your own accounts, on your own billing. That might be Google Workspace with Apps Script, Microsoft 365, Shopify, Stripe or your CRM. You own those accounts and everything we build in them.

• We get the least access the job needs.
• You grant it from your own account, and we list it in writing.
• We remove it when the work ends. You can remove it yourself at any time.
• Logins are shared through a shared vault in a password manager. Never by email or chat.
• We never store your passwords or keys in our own files.

If we will see customer, donor, order or invoice data, we sign a data processing addendum with you first.

• Your builds: in your own accounts.
• Client portal: hosted on Supabase, which runs the database and sign-in. Row-level security means each client sees only their own records.
• This website: hosted on Cloudflare.
• Our email: Google Workspace.

A build may use an AI model from Anthropic (Claude), OpenAI (ChatGPT or its API) or Google (Gemini). It runs on your own account or key. We pick the model for each job.

Each provider sets its own rules for the data you send it. Read the terms for the one your build uses.

• Anthropic: commercial terms and privacy center
• OpenAI: enterprise privacy
• Google: Gemini API terms

Nothing goes to a customer or donor in words you have not approved. A build may send a message you wrote and approved once, like an instant reply to a new inquiry or a booking reminder. Everything else waits for a person.

AI can be wrong. Builds flag numbers and facts for a person to check, and they say plainly what they cannot check.

• AI can write text that is wrong or made up.
• Our checks catch numbers, dates and listed words. They do not catch every wrong claim.
• Vendors change their tools and models, and a build may need updates when they do.
• We are not SOC 2 or ISO certified. We will fill out your security questionnaire on request.

Once a build is live, Kustos watches it. Kustos is our parent company, and it makes software that monitors running builds. After each run, a build writes a short status line with counts and errors. It holds no customer content.

Kustos checks those lines on a schedule and flags what breaks. Isaiah reviews flags on business days and approves every fix.

Email security@konsulco.com. We answer within 72 hours. Clients can also send a request from the client portal.

Our contact details for security researchers are in security.txt.