Security and data
What we keep, and what we don't
Your lists and results aren't stored; only receipts, agent settings and which companies an agent has covered are kept. Everything else on this page follows from that, and each line describes what the product does today.
Kept
- Receipts
- For every run: when it ran, how many rows, what it cost in credits and what was refunded, and the AI spend on your key. Decisions an AI reviewer made are kept as counts and reason codes, not as the leads.
- Agent settings
- The sentence, the plan it was read into, its schedule and where its leads go. An agent's key is never saved with it. A sentence's plan is kept so the same sentence runs the same way next time.
- Companies an agent has covered
- The website domains an agent has already delivered, so it doesn't send the same company twice. Domains only: nothing about the people at them.
- Held leads
- When a reviewer holds a lead for you, Programmable keeps the company's domain, the agent's settings, where it would have gone and the reason codes. Approving runs the agent again for that company; the person is looked up fresh, not stored.
- Campaigns an agent made
- The id and name of a campaign in your own sending tool, so later runs add to it instead of making another.
- Public company facts
- Facts about companies from public sources, like a site's tech stack or speed, so repeat lookups are fast. What your own providers return is never added to it.
- Your account
- Your name, work email, team, settings and billing records. Closing the account deletes it within 30 days, apart from billing records the law requires us to keep.
Not kept
- Your lists
- An upload is read in memory when it runs and then discarded. It isn't saved, and it isn't put in a link.
- Your results
- Sheets stream to you, or to the tools you send them to, as they're built. The rows aren't saved on our side; your download, sheet or CRM is the only copy.
- People
- Names, emails, titles and phone numbers found during a run go to you and nowhere else. They aren't kept after the run, pooled, sold or used to train AI.
- What your providers return
- Apollo, Hunter, People Data Labs or any provider you connect: their answers belong to your key. Never cached, never shared with another account.
- Your AI questions
- Questions run on your own AI key. The questions, the page text sent with them and the answers aren't kept; only the spend is counted.
Keys, links and webhooks
Your keys, encrypted
Provider and AI keys, and webhook signing secrets, are encrypted by the app with AES-256-GCM before they reach the database, using a key the database never holds, so the database alone never reveals them. They're decrypted only to make your own runs' calls, and kept out of error reports.
Links that can't be turned against you
A link from someone else shows its cost and asks before it runs. Share keys for spreadsheets and tools can be locked to one link, capped in rows and AI spend, set to expire, and refused permission to send to your tools; wrong keys are rate-limited.
Signed webhooks
Every delivery carries an HMAC-SHA256 signature over its timestamp and body, and an id that stays the same across retries. Deliveries go over HTTPS only, never to private, loopback or cloud metadata addresses (checked when connecting, which also covers DNS tricks), and redirects aren't followed.
Sending stays with you
An agent's campaign waits paused in your own sending tool until you start it, unless you set that agent to start by itself. Mail goes from your mailboxes, with your tool's own unsubscribe settings.
Opt-outs, honoured everywhere
Anyone can ask not to be returned by writing to opt.out@programmable.info or using the opt-out page.
- An opt-out is checked on every people row, search result, leadership list and webhook delivery, for every account.
- A person's email or phone is kept only as a SHA-256 hash, so the list of people who opted out can't be read back as a list of contacts.
- A company can opt out by its domain: its people and leaders aren't returned, and the try-it box on our pages won't look it up.
- We respect robots.txt on the company pages we read, and we never scrape LinkedIn.
The services involved
Each one is in the code that runs the product. AI models and data providers (Anthropic, OpenAI, Google Gemini, OpenRouter, Apollo, Hunter, People Data Labs and the rest) run on your own key, under your own agreement with them: we pass your request and return the answer. The formal list, with locations, is in the data processing agreement.
| Service | What for |
|---|---|
| OVHcloud | Servers in Virginia, US: the app, its database and sign-in, self-hosted. |
| Backblaze | Encrypted database backups. |
| Cloudflare | Network, TLS, bot checks on public forms, and the opt-out mailbox. |
| Stripe | Payments and subscriptions. Card details go to Stripe, never to us. |
| Resend | Account email: invites, notices, reminders. |
| Sentry | Error reports, with keys and personal data removed first. |
| Serper, Brave or Jina | Web search and reading public pages for discovery and research: search terms and page addresses only. |
| Google PageSpeed | Speed tests of a company's public website: the address only. |
| logo.dev | Company logos, by domain name. |
| Nango, self-hosted | The connections to your CRM and Google Sheets, on our own servers. |
Questions
Is Programmable SOC 2 certified?
No. We don't hold SOC 2 or another certification, and we won't claim one we don't have. This page and the data processing agreement say what we do instead, and we answer security questionnaires by email.
Can someone else's link spend my credits?
No. A link someone sends you shows what it will do and what it costs, with a Run button, before anything runs. Tools like Google Sheets and Zapier need a key, and a share key can be locked to one link, capped in rows and AI spend, set to expire, and allowed or not to send to your tools.
Does an agent send email without me?
Not by default. A campaign waits paused in your sending tool until you start it. An AI reviewer can hold anything unclear for you, and only an agent you set to start by itself ever does. Your tool sends, from your mailboxes.
Where is my data?
The servers, database and sign-in are in the United States (Virginia). People's data isn't processed for anyone in the EU, the EEA or the UK, or at companies based there: the service skips them.
Something we should look at? Write to support@programmable.you. See also the privacy policy.