Security and privacy
How LauncherUp looks after your company's data
Where your data lives, who can reach it, what the assistant may do on its own and how you take your data with you. The privacy policy has the legal detail.
Where your data lives
- Our servers and databases run in Germany, with Hostinger.
- Files, such as Library uploads and meeting recordings, are kept in Cloudflare R2 object storage. The bucket is private: every upload and download goes through our servers and no file link is ever handed out directly.
- Some AI providers process requests in other countries, including the United States, under the safeguards described in the privacy policy.
Each workspace kept separate
- Every record belongs to one workspace, and every request is checked against the workspace of the person making it.
- Stored files sit under their workspace's own path, and the storage layer refuses any other workspace's files.
- Sources in an answer only point to documents the person asking is allowed to open.
Encryption
- In transit: every LauncherUp app is served over HTTPS and sends HSTS, so browsers only connect over TLS.
- At rest: credentials for connected tools are encrypted with AES-256-GCM and never shown again after you save them.
- Passwords are stored as hashes, never as text.
Who can see and do what
- Roles and permissions decide who can read, write, approve and manage each area of the workspace. You can create your own roles.
- Gmail and Google Calendar are personal: each member connects their own, and only they use it.
- LauncherUp staff tools show workspace names, members, packages and usage totals for billing and support. They do not open your knowledge base, chats or files, and every staff action is recorded in an audit log.
Approval before changes
- By default, anything that writes to a connected tool waits for approval. The approver sees exactly what will run and can edit it first.
- Sending email always asks for approval, whatever the settings.
- Requests nobody answers expire: after 24 hours in chat and 72 hours for automations.
Safety limits on every run
- A watchdog stops a run after 40 tool calls, when it repeats the same call three times in a row, or when it would spend more than 300 credits.
- Runs have a time limit too: 10 minutes for an automation, 5 for an answer in the app's chat.
- An automation pauses after three failed runs in a row, and the person who created it gets an email. If a workspace spends credits unusually fast, all its automations pause.
Activity log
- Every tool call is recorded with the member it ran for, the tool, what it did and whether it succeeded, was declined or was blocked.
- Inputs and outputs are kept as short, masked summaries, so the log does not become a second copy of your data.
AI and your content
- When someone asks a question or an automation runs, the request and the context needed to answer it are sent to an AI model provider, which returns a reply.
- We do not use your content to train AI models, and we do not sell it or use it for advertising.
- The AI providers we use are listed with our other sub-processors in the privacy policy.
Export and deletion
- Owners can export the whole workspace, and every member can export their own data. The download link works for 7 days and the file is then deleted. Exports never include credentials.
- When an owner deletes a workspace, it is suspended at once and its connected tools are disconnected. All of its data and files are deleted after 30 days; until then, the owner can cancel from the link we email them.
- Anyone can delete their own account from their profile.
- Deleted data can remain in encrypted backups for a limited time until those backups are overwritten.
Error monitoring without personal data
- We use Sentry to find and fix errors. Reports leave out request contents, user details, breadcrumbs and extra context.
- Email addresses in error messages are masked and the text is cut to 1,000 characters.
Hardening
- Sign-in, signup, password reset, invitations and share codes are rate-limited.
- Every app sends security headers that stop other sites from framing it.
- Addresses a workspace configures, such as its own storage or MCP server, are checked so they cannot reach our internal network.
- This website sets no cookies and uses no analytics.
Your rights under GDPR and KVKK
You can ask to access, correct, delete or export your personal data, and most of it you can do yourself in the app. For anything else, or to report a security issue, email us. We answer within one month.