# How Amolfi protects your data

Source: https://amolfi.com/docs#security--how-amolfi-protects-your-data

Amolfi processes workspace data to provide AI assistance, maintain safety controls, create work receipts, debug errors, and improve product quality. It does not sell personal information or share it for cross-context behavioral advertising. The Privacy Policy describes these uses and your rights.

### Grounded, not generic

The AI is grounded on your own records — that’s what makes an answer about your business instead of a generic one. Your workspace is isolated from every other organization at the database layer, not just in the interface.

### Agents propose, owners approve

Agents propose rather than act: anything that moves money or leaves your workspace waits for a named owner to approve it, and sensitive server actions append to an audit log as they happen.

Service credentials are kept server-side. Access to bank items, billing, audit logs, and signing requests goes through server endpoints that enforce their own checks.

### Isolation

Your workspace is a sealed room. CRM, projects, finance, legal, and marketing run natively inside one boundary — not stitched across six vendors’ clouds. Every read and write is gated by membership at the database layer; deactivate a member and their access ends with them.

### Governed AI

AI with a gate, not a free hand. Agents draft from the records they’re permitted to read; risk tiers and review gates sit before anything a client could see; approved actions leave receipts — sensitive fields stripped first.

### Audit log

If it mattered, it’s in the log. Sensitive server actions append to an audit log as they happen — history is added to, not edited — with redaction at write time.

### Roles and access

Six roles, drawn precisely. From owner to guest, each person sees exactly the work they need — with per-module overrides and item-level guest scoping on top.

[Members & roles](https://amolfi.com/docs/workspace/members-and-roles)

### Server-only secrets

Service credentials stay on the server. Workspace API keys are shown once when you create them; store them securely. Requests for sensitive records go through server endpoints that enforce their own checks.

### Scoped links

One link, one job. Client intake forms, approvals, document signing, booking, creator delivery, and portal views — each link does the one thing it was made for, nothing else.

### Transport and files

Hosting sends HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a report-only Content Security Policy on live responses. File download endpoints re-check workspace or conversation access and return short-lived signed URLs.

### Integrations

Connections that prove themselves. Inbound webhooks verify provider signatures or HMAC tokens before anything is processed; outbound OAuth uses single-use, HMAC-bound state. Bank connections run through Plaid Link — credentials are entered with Plaid, never in Amolfi.

### Reporting a vulnerability

Found something? Email security@amolfi.com directly.

### Where to read more

The commitments above are contractual in the privacy policy and the terms:

[Privacy policy](https://amolfi.com/privacy)[Terms of service](https://amolfi.com/terms)