Your data, handled honestly.

Every business gets an isolated workspace inside our database. Your records are tagged with a unique company ID, and database-level row security rules (Postgres RLS on Supabase) ensure no query can return another company's data — not by mistake, not by misconfiguration, not by a developer running the wrong command. The same isolation rule lets us safely operate as a multi-tenant platform without your data ever sitting next to another company's in application memory.

All connections are TLS 1.2+ — your browser to our server, our server to our database, our server to Anthropic, our server to Stripe. We don't accept unencrypted connections. Period.

Database storage is encrypted at rest by Supabase (AES-256). File uploads (documents you store in the library) are encrypted at rest by Supabase Storage. Authentication tokens never touch our database — they live in Supabase Auth.

Your business data is never used to train AI models. When we send a prompt to Anthropic (Claude) on your behalf, we send it through their API — and Anthropic's API terms explicitly prohibit using API traffic for training. The same is true for any AI vendor we use.

What you put in stays yours. What Solomon learns about you stays in your workspace.

To run Eliv8 OS, we send minimum-necessary data to:

• Supabase — database, authentication, file storage. Your data lives here.
• Anthropic — runs Claude (the AI behind Solomon). We send the prompts and context the AI needs to answer your questions. Anthropic does not retain or train on this data.
• Stripe — billing. We send your email and subscription info. We do NOT see or store your credit card.
• QuickBooks (optional) — read-only financial sync. Only if you connect it. We never write to your books.
• ElevenLabs (optional) — turns Solomon’s written answer into speech, and only when you press Listen. We send that one answer. Nothing is sent if you never use it.
• Your browser’s speech recognition (optional) — if you dictate instead of typing. On Chrome this means the audio goes to Google to be turned into text; on Safari it is handled by Apple. Only while the microphone button is on.

That's the full list. No analytics tracking sold to third parties. No ad pixels. No data brokers.

Passwords are hashed with bcrypt — we can't see your password, even if we wanted to. Password reset flows go through email verification. Multi-factor authentication is on the roadmap.

Honest list of what's not done yet:

• Self-serve data export (today: email us and we'll send it)
• Multi-factor authentication (planned: 2026)
• SOC 2 Type II audit (planned once we cross 100 customers)
• Single sign-on for agency / multi-team accounts (planned)
• Data residency options (Canada-only / US-only) — currently North-America-wide via Supabase

If we discover a security issue affecting your data, we will email you within 72 hours of confirmation, describe what happened, what we're doing about it, and what you should do. No PR-spin, no "out of an abundance of caution" — just the facts.

If you find a vulnerability, please email us at support@eliv8os.com with details and steps to reproduce. We'll respond within 48 hours.

Ask us for an export any time — email support@eliv8os.com and we'll send your data over. It isn't self-serve yet; built-in export is on the list below. You can delete your workspace yourself from Settings → Danger zone, which removes it and all its data within 30 days (the 30 day window is for backup rotation — after that it's gone).