Documentation
Security and your data
Where data lives, who can see it, and how to take it with you.
Ansengine holds two sensitive things: the answers we captured about your brands, and the credentials you connected so we can act on your behalf. Both are scoped to your workspace and revocable by you.
How access is scoped
- Every table is org-scoped with row-level security. A brand id from another workspace returns empty rather than leaking.
- Seats mean the same thing everywhere: a read-only viewer key is read-only over the API and MCP too.
- Connected accounts are your own OAuth grants and can be revoked from Settings at any time.
- Contact data carries a time-to-live and is re-checked against suppression at the moment of use, not just at discovery.
- Client report links are unguessable tokens, optionally passphrase-locked, and scoped to one brand.
- Export your runs as CSV and your captured answers as JSON whenever you like.
Keys and revocation
API keys are shown once at creation and can be revoked individually, so a leaked key is a one-line fix rather than a rotation of everything. The same key works for the REST API and for MCP, and a read-only seat's key stays read-only on both.
A viewer seat is workspace-wide, not per brand. Give clients the share link, which is scoped to their brand alone, and keep seats for your own team.
The security page carries the deployment detail (transport, storage, subprocessors) and the privacy policy carries the legal basis. This page is the operational summary.
