Security — Bella

How we think about security

Four principles, built into the product — not bolted on afterward.

✓

You're in control

You decide what Bella can see and do. She starts by observing, and nothing is sent, moved, or changed without your approval — unless you explicitly say otherwise.

☰

Everything is visible

Every action Bella takes — an email drafted, a meeting moved, a receipt filed — is logged and shown to you. No silent activity, ever.

Data is protected

Your data is encrypted in transit and at rest. Credentials live in an encrypted vault and are never exposed to the AI model itself.

◉

Always on watch

Our infrastructure is monitored around the clock, with regular vulnerability scanning and an incident response plan we hope to never use.

Under the hood

The technical details, in plain language.

Encryption

TLS 1.2+ for everything in transit, AES-256 for everything at rest. Your emails, events, and documents are never stored in the clear.

Account access

Bella connects to your calendar and email through OAuth — she never sees or stores your passwords, and you can revoke her access in one click at any time.

Credential vault

Tokens and keys are kept in a dedicated encrypted vault and injected at runtime. The AI model never sees a credential — it can't leak what it can't read.

Isolation

Every account runs in its own sandbox. Your data is never mixed with anyone else's, and no one else's Bella can reach yours.

Human approval

Sensitive actions — sending email, moving money-adjacent things like invoices and receipts — require your explicit sign-off. Not a policy. The architecture.

Monitoring

Real-time anomaly detection, routine vulnerability scanning, and periodic penetration testing. Issues are triaged and patched on a defined response timeline.

What we will never do with your data

The short version of our privacy stance — the full policy says the same thing in more words.

✓Never stored. Your emails, events, and documents are processed in the moment — never kept on our servers.
✓Never used for training. Your emails, events, and documents are not used to train AI models — ours or anyone else's.
✓Never kept against your will. Delete your account and your data goes with it. You can request export or deletion at any time.
✓Never read by people. No human reads your email. Access to production data is tightly restricted, logged, and only used to fix an issue you've asked us to fix.

Found something?

We take reports from security researchers seriously and respond quickly. If you believe you've found a vulnerability, tell us privately and we'll work with you to fix it.

sales@alwaysworks.ai

Questions people actually ask

Does Bella read all my email?

She reads what you give her access to, in order to summarize, draft, and follow up. You can scope her access to specific accounts or folders, and revoke it any time.

Can she send email without me knowing?

No. By default, every outgoing message needs your approval. If you turn on auto-send for certain kinds of replies, that's your call — and every send is still logged.

What happens to my data if I cancel?

Your connected accounts are disconnected immediately, and your stored data is deleted on a defined schedule. You can request immediate deletion or a full export first.

Where can I get more detail?

Reach out at sales@alwaysworks.ai. We're happy to answer specific questions about our architecture, data handling, or privacy practices.