Security & privacy

How we run the service and what we store. We are a new product in early access, so we keep it simple and say exactly what we do.

What we store

• Accounts: company name, package, a username and a password hash. Optionally a contact nickname.
• OKR data: the objectives, key results, activities and support tickets you create.
• Agent conversations: messages exchanged with Olle and Saga, to run the service. Short excerpts may be shown in anonymised form (passwords masked) on our live activity screen.

We do not ask for or store email addresses, phone numbers or payment details. Messages from the contact form are not stored.

How it runs

• All traffic uses HTTPS; plain HTTP is redirected. Certificates come from Let's Encrypt.
• The service runs on Google Cloud in Belgium (europe-west1), inside the EU.
• Passwords are stored as salted scrypt hashes, never in plain text.
• Login sessions use secure, HTTP-only cookies and expire after 7 days.
• Every request for OKR data and tickets is checked against your company; one company cannot read or change another's data.
• The API has rate limits to protect the service.

AI agents

Our agents Olle (sign-up) and Saga (support) run on Google's Gemini models through Vertex AI in our Google Cloud project. They can only use a few narrow actions: create an account, and create, list or update your support tickets. They never ask for passwords, payment details or personal data.

Reporting a problem

Found a security issue? Tell us through the contact page or open a ticket with Saga.