Security

1. How We Protect Data

• Two-step sign-in is required for every Admin user on the live service and for all Go1000.ai staff.
• Each business sees only its own data: separation is enforced in the database itself (row-level security), not just in the app, and is checked by automated tests.
• Encryption in transit (TLS) and at rest; connected-account tokens and secrets are encrypted again by Go1000.ai.
• Least access: team roles in Admin; Go1000.ai support opens an account only with a logged reason that the business sees, for a limited time, and every change it makes is in the account's history.
• Less sensitive data: Social Security and card numbers are hidden in portal messages and AI chats; clients are asked to black them out of uploads; AI providers don't train on your data.
• Records: audit logs for approvals and sensitive actions; orders are archived, never deleted, while your plan is active; an append-only billing record.
• Backups and recovery through our managed database provider.
• Spam and abuse protection on every public form.

2. Your Safeguards Rule Package

In Admin → Settings → Security Program, every business gets a written information security program filled in with its own details, the Data Processing Agreement with Go1000.ai, and an incident response plan. The rule also asks you to name a Qualified Individual, assess your risks, train your team, and review the program yearly: the program walks you through each item.

3. If Something Happens

We notify affected businesses within 72 hours of confirming a security incident and help them with their own notices (including the FTC notice within 30 days for events affecting 500 or more people).

4. Report a Vulnerability

If you believe you've found a security problem, tell us privately through the request form. Please don't access other people's data or disrupt the service. We won't take legal action against good-faith research reported this way, and we'll tell you when it's fixed.