Security
You are trusting us with other people’s data.
An inquiry carries a name, a contact address, sometimes a photo of someone’s house. “We take security seriously” tells you nothing, so here is where it is kept, who can read it, and what we hand to a model.
Where the data lives
- Inquiries, drafts and attachments are stored in Supabase on AWS in Tokyo (ap-northeast-1), encrypted at rest by the platform.
- Application code runs in Tokyo as well (Vercel hnd1), so requests do not cross an ocean to reach the database.
- Everything is TLS: the form endpoint, the dashboard and the API.
Who can read it
- Row-level security scopes every table to a workspace. One customer's data is not reachable from another's session — structurally, not by convention.
- Every dashboard query is additionally filtered by the workspace you have selected.
- We (LINKAKU Inc.) access data only to investigate a fault or abuse report. We do not read inboxes as a matter of course.
What reaches the AI
- To classify and draft, we send the inquiry text, your saved FAQ entries and your recently approved replies to Anthropic's API. Attached photos are sent as images.
- Anthropic does not train on API data by default. Nothing you receive influences another customer's drafts.
- The AI stops at a draft. Nothing is sent until a human approves it.
- There is no per-form switch to disable AI yet. If some inquiries must never reach a model, use a separate form for them.
Sign-in and keys
- There are no passwords. Sign-in is a six-digit code by email; the code is stored hashed, expires in 10 minutes, and allows five attempts.
- API keys are shown once at creation. Only a hash is stored. Revoking one takes effect immediately.
- Invitation and workspace-transfer links store only a hash of the token.
Attachments
- Stored in a private bucket with no public URL.
- Each view mints a signed URL that expires in 10 minutes, so a leaked link stops working.
- Up to 5 files per submission, 10MB each, 25MB total. Executables are rejected.
Abuse controls
- A honeypot field, per-IP rate limits and an allowed-origins list drop automated submissions before they are stored.
- New workspaces are capped at 30 inquiries per hour. Any workspace crossing 300 in an hour is suspended automatically.
- Notifications only go to addresses someone has confirmed. If anyone could point them at any address, this would become a relay for unwanted mail — our sending reputation would fall, and the notifications that matter would stop arriving.
- Who did what, and when, is recorded: sign-ins, settings changes, replies sent, data exports. The last 90 days are visible under Settings → Activity log, on every plan.
- The log never stores values. It records that the Slack destination changed, not the URL — a log that holds secrets is one more thing to protect.
- Outbound mail is capped at 60 per hour, and a suspended workspace sends nothing at all.
Export and deletion
- Inquiries, drafts and reply history export to JSON at any time from the dashboard.
- Deleting a workspace deletes its data. That cannot be undone.
- Cancelling a plan does not delete anything. Deletion is your action, not ours.
Subprocessors
This is the complete list of services your data passes through.
| Service | Role | Region |
|---|---|---|
| Supabase | Database, file storage, auth | AWS Tokyo |
| Vercel | Application hosting and compute | Tokyo (hnd1) |
| Resend / Amazon SES | Sending and receiving mail | Tokyo |
| Anthropic | Classification and drafting | United States |
| Stripe | Payments (card data never touches us) | United States |
What we do not have
We will not describe controls we have not built. If your procurement needs any of these, talk to us before you commit.
- Third-party certification (SOC 2, ISO 27001)
- SAML / SSO sign-in
- Exportable audit logs
- A choice of storage region (Tokyo only today)
- A per-form switch to disable AI