Trust Center
Security you can actually check.
Growthstory handles your email, documents, recordings and operational data. This is the honest state of how we protect it — what's in place, and what isn't yet. We're an early-stage company with disciplined engineering practices, not SOC 2 certified and without a third-party penetration test — and we'd rather tell you that than imply otherwise.
Security documents
Request any of these and a person sends it the same day.
Incident Response Policy
Our written process for a security event — owner, containment, notification.
Request →Data Retention & Deletion
What we keep, for how long, and how a deletion request reaches backups.
Request →Subprocessor List
Every third party that touches your data, and what each receives.
View on this page →Engagement Security Summary
A per-client summary of exactly what we access inside your environment.
Request →Controls in place
23 controls across five areas. Where something is on the roadmap rather than live, it says so.
- HTTPS/TLS for web traffic. All web traffic is served over TLS; database-connection TLS is not yet verified and is on the roadmap.
- Private database. Postgres is reachable only over the private network — never exposed to the public internet.
- Redundant web tier. The web service runs multiple replicas.
- Verified backups. Hourly logical database dumps, read-verified on every run, plus daily platform backups.
- Availability monitoring. Uptime checks and a dead-man's-switch alert the moment something fails.
- Secrets management. Credentials live in environment variables and protected key files — never in the repository.
- Invitation-only portal. The client portal is invite-based, with server-side sessions that can be revoked instantly.
- Separate low-privilege MCP. Public MCP onboarding is a deliberately separate surface from the portal.
- Constant-time admin auth. Admin access is gated by a strong token compared in constant time, over HTTPS only.
- MFA & per-admin identity — on roadmap. We don't yet have per-admin identity or MFA, and we say so rather than imply otherwise.
- Retention & deletion. A documented policy, including the backup exception — deletions age out of backups (≤21 days) and restores re-apply pending deletions.
- No training on your data. We don't use your data to train models.
- Least-privilege engagements. When we work in your systems we use a client-owned, scoped integration — the fence goes up before any permission is granted.
- Prototype data discipline. Synthetic or redacted data only in prototype environments until a hosting arrangement is agreed.
- DPA available. A Data Processing Agreement is available on request.
- Adversarial code review. Changes go through a cross-model (Codex) review loop with a documented decision log.
- CI gate. A continuous-integration gate runs before changes land.
- Dependency scanning. Dependencies are scanned with npm audit; a formal vulnerability-management program is on the roadmap.
- Human-gated deploys. Merges to production and prod deploys are human-gated, not automatic.
- Named owner & channel. A written policy with an owner and a reporting channel (security@growthstory.ai).
- Immediate containment. Credential rotation and session revocation are the first containment steps.
- Client notification. If data is or may be exposed, we notify affected clients without undue delay.
- Silent-exfil detection — on roadmap. Automated detection of a stolen-credential exfiltration event is a known gap we name, not hide.
Subprocessors
The third parties that process data on our behalf.
| Provider | Purpose | Data received | Region |
|---|---|---|---|
| Railway | Hosting + Postgres database | All application data (internal-only DB) | US |
| Resend | Transactional email | Recipient address + email content | US |
| Google Workspace | Email + documents | Correspondence, documents | US |
| Stripe | Payments (portal) | Payment details (held by Stripe, not us) | US |
| ElevenLabs | Interview voice | Interview audio | US |
| Anthropic / OpenAI | AI processing | Interview transcripts, generated material | US |
Per-subprocessor retention and model-training terms are in our full security package. A customer's own AI connecting to us over MCP is the customer's chosen provider, not one we route.
Resources & contact
For a document above, an engagement-specific summary, a vendor review, or to report a security concern: security@growthstory.ai — escalated to the owner immediately. For a DPA, a privacy question, or a data access/deletion request: privacy@growthstory.ai.
Last updated 2026-10-25 · Growthstory AI Inc., Noblesville, Indiana.