Skip to content
Pebbles Ai

Trust & data

Clarity before confidence

Your company information and customer conversations deserve careful decisions. Understand how a workflow operates, what it can access and where your review belongs.

Working with AI

Keep judgement in the process

Execution

Know the action

Assistants work in Auto, Plan or Manual mode, and the web app starts in Manual. In Manual, sends, posts, CRM writes, MCP calls, calendar changes and starting lead generation wait for your approval. Plan queues them. Auto runs them without asking, except template send and calendar deletions, which always ask first. Confirm the mode for your workflow before making external changes.

Evidence

Review the output

AI can make mistakes. Inspect research sources, review messages and check records before using outputs in consequential decisions.

Context

Understand the data

Company Intel, including brand voice, is not the same as model-weight training. Agent memory can be switched off with "Remember my conversations" in Settings. Consult the current policies for data processing, retention and other privacy terms.

In the product

Safeguards in place today

Uploads

Files are scanned

Uploaded files are virus-scanned, and a file flagged as infected is blocked.

Code

An isolated sandbox

Code runs in an isolated sandbox with no outbound network access and a read-only file system. Each run writes an audit line and stops after 180 seconds.

Sign-in

Passwordless sign-in

Sign in with Google, Microsoft or a one-time code sent by email. Session cookies are host-only.

Independent review

Assessed by third parties

  • CASA II Certified

    App Defense Alliance, Cloud Application Security Assessment Tier 2

    The independent security assessment Google requires of applications that connect to Gmail and Google Workspace data.

  • Microsoft 365 Certified

    Microsoft 365 App Compliance Program

    Microsoft's certification of the security and data-handling practices behind the Outlook and Microsoft 365 connections.

  • GDPR

    EU General Data Protection Regulation and UK GDPR

    How we collect, process, store and delete personal data under EU and UK data protection law.

  • SOC 2 Type IIPending

    AICPA System and Organization Controls 2, Type II report

    An independent audit of how our security controls work over time, against the AICPA Trust Services Criteria, targeted for Q2 2027.

  • ISO 27001Pending

    ISO/IEC 27001 information security management

    Certification of our information security management system by an accredited body, targeted for Q2 2027.

Certification documentation is available through the trust centre before you commit.

Source documents

Go directly to the policies

Use the trust centre and published privacy policy for current documentation. For procurement or security review, ask the team for evidence relevant to your requirements.

Evaluating a team or enterprise setup?

Discuss connected providers, access controls, data requirements and the workflows you intend to run. The trust centre holds the certification evidence, and the team provides contractual terms.

Contact the team