Documentation

Security and your data

Where data lives, who can see it, and how to take it with you.

Ansengine holds two sensitive things: the answers we captured about your brands, and the credentials you connected so we can act on your behalf. Both are scoped to your workspace and revocable by you.

How access is scoped

Every tenant table is org scoped with row level security. The tables that hold no tenant data carry no tenant policy, because there is no tenant in them: the shared ones the application uses (answer_cache, rate_limits, provider_outages, derived_platform_events), and the platform's own records, which the application's database role cannot read at all. A brand id from another workspace returns empty rather than leaking.
Seats mean the same thing everywhere: a read-only viewer key is read-only over the API and MCP too.
Connected accounts are your own OAuth grants and can be revoked from Settings at any time.
Contact data carries a time-to-live and is re-checked against suppression at the moment of use, not just at discovery.
Client report links are unguessable tokens, optionally passphrase-locked, and scoped to one brand.
Export your runs as CSV and your captured answers as JSON whenever you like.

Keys and revocation

Note

API keys are shown once at creation and can be revoked individually, so a leaked key is a one-line fix rather than a rotation of everything. The same key works for the REST API and for MCP, and a read-only seat's key stays read-only on both.

Know this

A seat sees every client unless an admin limits it to named clients under Settings, Team. Give a client a seat limited to their own brand, or the share link, which is scoped to that brand alone.

The security page carries the deployment detail (transport, storage, subprocessors) and the privacy policy carries the legal basis. This page is the operational summary.