Trust & Security

Data protection

• Encryption. All traffic uses HTTPS (TLS) with HSTS. Data stored in our database and file storage is encrypted at rest by our hosting providers.
• Separation between customers. Access to every table is enforced inside the database (row-level security), so a user or organization can only read their own data.
• Who can see what. Your private coaching conversations and analyses are visible only to you. If you are on a team, your team lead can see your profile details (such as name, email, job title and behavioral profile) and team-level analytics, not your private conversations. A small number of CreateOne administrators can access account data for support and security.
• Audit trail. Changes to privileged account settings (roles, plans, team membership) and account deletions are recorded in an audit log.
• Passwords and sign-in. Passwords are stored only as salted hashes by our authentication provider. Sign-up, sign-in and password reset are protected by a bot check (Cloudflare Turnstile). Enterprise teams can ask for SAML single sign-on with their own identity provider.

AI and your data

• Coaching messages, transcripts and voice you submit are sent to Google's Gemini API to generate responses. We use Google's paid API service, under which Google states it does not use prompts or responses to improve its products. Google may retain them for a limited period to detect abuse and meet legal obligations.
• We do not use your private conversations, transcripts or voice to train AI models.
• Zero-retention mode (Enterprise, on request) covers meeting transcript and recording analysis in Shadow Coach: the result is shown once, can be downloaded, and is not saved on our servers. It does not change how other features store data, and it does not remove the limited provider-side retention described above.
• AI output is advisory. We do not make automated decisions about you with legal or similarly significant effects.

Where your data is processed (sub-processors)

These providers process data on our behalf. We keep this list current and it is the same list as in our Privacy Policy.

Application and infrastructure security

• Security headers on all pages, and a content security policy being rolled out.
• We scan our code and dependencies automatically for known vulnerabilities and accidentally committed secrets, and fix what is found.
• AI requests go through authenticated server functions with per-user rate limits; AI provider keys are never exposed to browsers.
• Scheduled back-end jobs accept only our own service credentials.
• On our marketing website, Google Analytics, advertising tags and visitor-location logging run only if you accept them in the cookie banner.

Your data, your control

• Export a copy of your data, or permanently delete your account, from Profile in the app.
• We delete data we no longer need on a schedule (for example website visit records after 12 months). Details are in the Privacy Policy.
• Payment details are handled by Stripe. We never store card numbers.

Reliability and incidents

• We take regular database backups and test that they restore.
• We have a documented incident response plan. If a data breach is likely to cause serious harm, we notify affected people and the regulator as required, including under the Australian Notifiable Data Breaches scheme and, where the GDPR applies, within 72 hours.

Certifications and independent assurance

Get Savvy is not yet SOC 2 or ISO 27001 certified, and has not yet had an independent penetration test. We plan to pursue independent assurance as our enterprise customer base grows. Until then, we are glad to answer a security questionnaire and walk your team through how the platform works.

Enterprise requests

Procurement teams can ask us for a data processing agreement, a completed security questionnaire, single sign-on setup, or zero-retention mode. Email info@createone.com.

Report a security issue

If you believe you have found a vulnerability, please email info@createone.com (see also our security.txt). Please include enough detail to reproduce it, avoid accessing other people's data, and give us reasonable time to fix it before sharing it publicly. We will acknowledge good-faith reports and will not pursue action against researchers who follow these guidelines.