We respect your privacy
We use cookies to keep you logged in and understand how you use Pocodot. You can customize your preferences or accept all. Cookie Policy
Security & Privacy
Pocodot reads your messages, runs your tasks, and holds the keys to your tools. That's a lot of trust. Here's exactly what we do to deserve it.
Each one is something we do today, or something we're rolling out within weeks. Where we're not all the way there yet, we say so.
Our AI processes your messages so it can reply. No human at Pocodot reads them as a normal part of our work.
Nothing you do, say, or store can leak into another customer's workspace. Our system is built to refuse cross-customer requests.
Every service that offers an official login (Slack, Google, Notion) is connected through it, and we never see those passwords. Logins you choose to store in Cole's Vault are encrypted with a key specific to your workspace, used only to sign in on that site, optionally with your approval every time, and you can delete them at any time.
Your conversations are never used to train AI - not ours, not OpenAI's, not Google's. We have signed contracts that prohibit it.
When you delete your workspace, we destroy the key that unlocks your data. Even our backups become unreadable.
Enterprise customers can run on their own private Pocodot - own database, own server, own keys. Nobody else shares it.
Plain answers, no hedging.
No. Every piece of data we store is tagged with your workspace. Every part of our system checks that tag before answering any question. We have automated tests that try to break this rule - they have to pass before any code change ships. We're adding a second layer of protection at the database level so even a future bug can't leak your data.
No. The AI providers we use (Anthropic, OpenAI, Google) are contractually forbidden from training on your data. Our integration partner (Composio) may use anonymized usage statistics - never your message content. The full breakdown is on our Sub-processor page.
Then we tell you within 72 hours. We'll explain what happened, what was affected, and what to do. We follow GDPR Article 33 to the letter. Our incident plan covers detection, containment, customer notice, and a public post-mortem afterward - so the same mistake can't happen twice.
You get an email confirming your data has been destroyed. The email includes a deletion certificate signed with our public signing key - which means you can independently verify it wasn't faked. The key fingerprint is published at /security/deletion-key.
Plain access controls. You're always in charge of who has the keys.
Your password is never stored as text.
One click, no password to remember.
We email you a one-time link.
An extra code from your phone, every time you sign in.
For teams using Okta, Microsoft, Google Workspace, or OneLogin.
Anytime, in your settings. Sign anyone out with one click.
The companies that help us run Pocodot. We give 30 days' notice before adding any new one.
No spin. Just where we are.
Live status is published.
We're working with a top-tier auditor toward SOC 2 Type II - the gold standard for SaaS security. The audit window opens this summer; the report follows.
Email privacy@pocodot.ai or grab the template from our trust portal.
Talk to us if you need it sooner.
Twenty answers in plain English. Each one is yes-or-no first, then the why.
On secure servers in Singapore today. Enterprise customers can choose the United States, Europe, or Asia-Pacific.
Pocodot's AI processes your messages so it can reply - that's its job. No human at Pocodot reads your messages as part of normal work. A small group of named on-call engineers can look at logs during a support investigation, and that access is itself logged.
No. Never. It's written into our privacy policy and our customer contracts.
No. Our AI providers (Anthropic, OpenAI, Google) are contractually forbidden from training on your data. Our integrations partner (Composio) only sees anonymized usage patterns - never message content.
Yes. Everything you save with us is scrambled - both when it's traveling over the internet and when it's sitting in our database. Only Pocodot's running system can unscramble it, and only when you ask it to.
Yes. Every workspace gets its own encryption key. One customer's key cannot open another customer's data - even by mistake.
We're not end-to-end encrypted, and we won't pretend to be. Pocodot is an AI assistant - it has to read and act on your messages to do its job. We protect your data at every other step (in transit, at rest, in our backups), but our system does see the message content while it's working.
Yes. Click "Download my data" in your settings. You'll get a single zip file with everything Pocodot knows about you.
Yes. Click "Delete my workspace" in your settings. We destroy the key that unlocks your data. You'll get a signed certificate by email confirming it.
Yes. The email contains the certificate, the data inside it, and the steps to verify it with one open-source command. Our public signing key is published at /security/deletion-key - so you don't have to take our word for any of it.
You see every active sign-in in your settings - device, location, last active. One click signs anyone out. When teammates leave, removing them from your workspace removes all their access immediately.
Yes - rolling out shortly. You'll be able to require an extra one-time code (from an authenticator app or a security key) for every sign-in.
Yes - rolling out for Enterprise customers. Single sign-on with SAML 2.0 and automatic user provisioning (SCIM).
Not yet - and we won't pretend otherwise. We're in the audit process now with a top-tier auditor. The report is expected within the next few quarters. We'll publish it the moment we have it.
Yes. We can sign a Data Processing Agreement with you in minutes. Email privacy@pocodot.ai or grab the template from our trust portal.
HIPAA is coming with our Enterprise plan. Healthcare prospects: talk to us so we can sequence your timeline.
Two places. Our security architecture page is the long technical version of everything here. Our trust portal hosts our compliance documents behind a one-click NDA.
We tell affected customers within 72 hours, in line with GDPR Article 33. We explain what happened, what was affected, and what to do. We publish a public post-mortem on our blog within 30 days unless legal counsel says otherwise.
Your data isn't held hostage. You can export everything at any time. If we ever shut down, we'll give you 90 days' notice and the tools to take your data with you.
Email security@pocodot.ai. Include what you found and how to reproduce it. We credit responsible reporters in our release notes (with their permission). Our PGP key is on our deletion-key page.
Every connection uses Slack's official login. Tap any item to see why we ask, and how to revoke it in one click.
channels:readWhy we need it: So Cole can find the right channel when you ask 'post this to #marketing'.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
channels:joinWhy we need it: So Cole can automatically join public channels and learn your team's context without manual invites.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
chat:writeWhy we need it: So Cole can reply, post summaries, and send the messages you ask for.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
im:historyWhy we need it: So Cole can carry on a conversation with you, not start fresh on every message.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
users:readWhy we need it: So Cole can route 'send this to Sara' to the right teammate.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
files:readWhy we need it: So Cole can summarise the deck or PDF you just dropped in the chat.
How to revoke: Slack → Apps → Pocodot → Configuration → Remove App.
We've answered most questions on this page. For the rest, talk to us. Most replies within one business day.
Join thousands of teams using AI agents to automate work.