Effective Date: October 9, 2026. This page is informational and is not a contract. It describes, in plain words, how Itogai LLC (“itogai”) protects the data in the Subscription Service today, and it carries the one table of what itogai holds and does not hold. The commitments that bind itogai sit in Section 12 of the Privacy Policy, Annex II of the Data Processing Agreement and the Customer Terms of Service; where this page and one of those differ, the document governs. Every statement here is true on the day it publishes and stays true afterwards: when a report, a certificate or a listing arrives, it is added to the table below with its date, and nothing else on this page waits for one. Last Modified: October 9, 2026 Document Version: SEC-2026-10-09 v5.1
itogai is a bootstrapped company with no investors and no board, run by a founder and a small team of contractors, and every person on the team is named in the policies by role. That is the size of the company the program below is built for, and the program covers everything itogai runs: the platform at platform.itogai.app and its production stack, the marketing website, the internal tools, the devices the team works on, the AI tools the team builds with, and every vendor that touches personal data.
1. What itogai holds today
| Item | Status | Date | What it means |
|---|---|---|---|
| App Defense Alliance CASA verification, Assurance Level 1 (formerly Tier 2) | Held | Current Letter of Validation issued December 31, 2025, expiring January 1, 2027; renewed annually, and the date of each new Letter is recorded here when it issues | An independent assessment of the security controls behind itogai’s Google API integrations and the metadata-only handling of Gmail. It is not an assessment of the whole Subscription Service and it is not a substitute for SOC 2 or ISO/IEC 27001 |
| SOC 2 Type II report | Not held | No report exists | itogai’s control set is mapped to all five Trust Services categories so that a report, when one exists, is a date here and not a change anywhere else. itogai does not describe a report as in progress or under way |
| ISO/IEC 27001 certificate | Not held | No certificate exists | The control set is mapped to ISO/IEC 27001:2022 Annex A for the same reason |
| ISO/IEC 27701 and ISO/IEC 42001 | Not held | No certificate exists | Mapped, not certified |
| Independent penetration test | Not yet performed | The first test is due within the first year of the program; its summary letter will be available under a confidentiality agreement once it exists | itogai’s policy sets an annual independent test of the production platform |
| EU-U.S. Data Privacy Framework (with the UK and Swiss extensions) | Self-certifying; not yet listed | Listing date to be stated here when the Department of Commerce publishes it | Until listed, itogai makes no claim of participation, and transfers rest on the Standard Contractual Clauses and the UK Addendum in the Data Processing Agreement |
| Written security, privacy and AI governance program | Held | Approved September 21, 2026; every policy reviewed at least annually | One control set of forty-four controls, twelve named policies with owner roles and review dates, a privacy working set and an index; available to customers and auditors under a confidentiality agreement |
| Data Processing Agreement with the Standard Contractual Clauses, the UK Addendum and the Latin American transfer clauses | Held | Published September 21, 2026 | Signed by every customer on account creation; a countersigned counterpart on request |
| Quarterly access review | Held | First review recorded September 29, 2026; repeated every quarter | Every human account, service account and key on every system, reviewed and signed by two reviewers |
| Incident response plan with the notification clock | Held | Approved September 21, 2026; exercised annually | Covers customers, supervisory authorities and individuals under every law that applies to itogai |
2. How itogai is built
itogai is concentric circles with the person at the center. TrustGraph™ scores, TrustRings™ organizes, TrustReach™ acts, Akai™ threads through, Network Health pulses. Everything in an account comes from data the person brought in themselves and turned on themselves: a connected account, an uploaded archive or file, a conversation export, a page read on screen, or a contact typed in. Nothing is read in the background, nothing is scraped, and nothing is sent on anyone’s behalf.
A person is always in the loop. No message leaves itogai without a person reviewing it and clicking send. There is no automatic send, no scheduled send, no sequence and no cadence, and itogai’s build checks fail any change that would create one. Akai, itogai’s relationship intelligence co-pilot, drafts, surfaces and explains; it never sends. A TrustGraph score is a probabilistic estimate from the signals available to it and support for a person’s own judgment, never a verdict, and every generated text says that it was generated.
3. The controls, in plain words
Encryption. Everything in transit uses TLS 1.2 or higher. Everything at rest is encrypted with AES-256 or the platform’s equivalent, on every database, backup and integration token, and the tokens that connect a person’s sources are encrypted a second time at the application layer. itogai does not describe any of this as end-to-end encryption, because it is not.
What is read, and what is never stored. Email is read as metadata only, permanently: who, when, how often, and never a message body. A source the person turns content signals on for is read once, in memory, to derive relationship signals, and the text is discarded; only the signal is kept. A file a person uploads is deleted as soon as it has been processed. An automated test runs on every build and fails it if a message body, a preview snippet or conversation text ever appears in a database write, a log, a queue, an analytics event or an error report.
Tenant isolation. Every table that holds customer, contact or account data is protected by row-level security at the database layer, checked by an automated report on every database change. No path in the product serves one customer’s contact data to another, except a connection both people agreed to or a Group both belong to.
Secrets. Secrets live only in the hosting platform’s managed variable store, scoped to the one service that needs each of them. None sits in code, in a log, in a ticket or in anything a browser downloads. A secret that is ever exposed is rotated the same day.
Hosting and networks. itogai’s application compute, its queue and its attached storage run in a single United States region on a managed hosting provider; the primary database runs on a managed database provider. No database is reachable from the public internet, in any environment. The Sub-processors register lists every provider and where each processes data.
Access. itogai never stores a password: every person signs in through itogai’s identity provider, which offers multi-factor authentication to every account. Every itogai administrative and tool account requires multi-factor authentication. Production access is a separate grant, held by the fewest people, reviewed every quarter, and revoked within one business day when someone leaves. Support staff see counts, never message bodies, because none are stored, and every administrative action is logged with who did what and when.
Change management. Every change enters through a development branch and a pull request, passes automated checks (build, tests, dependency and secret scanning, the content test above), is reviewed by someone other than its author, and is merged only by itogai’s engineering team. AI coding tools help build itogai under the same rules: they open pull requests, never merge, never hold a production secret and never see customer data. Development, preview and production are separate environments, and production data never leaves production.
Monitoring and incidents. Production is monitored for errors, availability and security signals, with alerting to an on-call engineer. itogai’s incident plan sets severity levels, roles and a notification clock: customers without undue delay and where feasible within seventy-two hours, supervisory authorities within the period each law sets, and affected individuals as the law requires, including Florida’s thirty-day rule.
Backups and recovery. Encrypted backups run daily and are kept for ninety days on a rolling schedule; a deletion propagates through that cycle. Restores are tested every quarter against a written recovery plan that names every dependency and what happens if it fails.
Vendors. Every vendor that touches personal data is reviewed before engagement, bound by a written agreement, listed publicly with its location, and reviewed annually. Adding a sub-processor carries thirty days’ notice and an objection right. Every AI model provider is listed in the AI Provider Register with its training and retention position read on its terms and dated; a provider that will not commit to no training on itogai’s data is not engaged.
People. Every person who works for itogai is a contractor who signs confidentiality, security and processor terms before any access, works on a device that meets a written baseline (full-disk encryption, screen lock, current operating system, multi-factor authentication), completes security and privacy awareness on joining and every year, and is verified before production access. itogai’s development partner works inside systems itogai owns, under the same terms. itogai’s team accesses production systems from the United States and from Colombia, and stores nothing locally.
AI governance. Only providers in the AI Provider Register can receive prompt content. Every request runs inside a limit on the text it may carry; email bodies are never sent to a provider, on any key; content from a source is handled as data and never as an instruction; and a model’s output is treated as untrusted until a person reviews it. itogai checks the behaviour of every AI feature before each release that touches it, and treats a message sent without a click as a security incident.
4. Where data lives
Application compute, the queue and the attached storage volume: one United States region. The primary database: a managed provider in the United States. Backups: the providers’ backup storage in the same jurisdiction. Model providers: nothing stored beyond the short period each provider’s verified terms set for abuse monitoring, or nothing at all where itogai holds a zero-data-retention agreement, as the AI Provider Register states per provider. Every other location is in the Sub-processors register, and the Privacy Policy Section 10 states the transfer instruments.
5. What itogai never does
itogai never sells or shares the personal data of anyone in a user’s network; never pools contact data across accounts to build a profile of a person; never reads an email body; never writes message text to a database, a log or an analytics event; never sends a message without a person’s click; never stores a password; never places a database on the public internet; never puts a secret in anything a browser downloads; never lets an AI tool merge code or hold a production secret; never claims a certification before the certificate exists; and never keeps data longer than the Privacy Policy says.
6. Reporting a security issue
Write to legal@itogai.com. itogai acknowledges receipt within five business days, investigates in good faith, tells you what it found and what it intends to do within thirty days, and credits you if you would like to be credited. Testing itogai’s systems requires written authorization first, which the same address grants; reporting something you have already found in good faith is never treated as a violation. Section 5 of the Acceptable Use Policy states the full route. itogai does not run a paid bounty programme.
7. Documents available under a confidentiality agreement
The twelve policies (information security; access control; change management; risk assessment and treatment; vendor and subprocessor management; incident response; business continuity and disaster recovery; data classification and handling; data retention and disposal; secure development including AI governance; internal acceptable use including AI tools; personnel security), the control crosswalk, the records of processing, the legitimate interest assessment, the data protection impact assessment, the current CASA Letter of Validation and, once it exists, the penetration test summary letter. Request them at legal@itogai.com; itogai answers within ten business days.
8. The commitments, where they are written
| Commitment | Where |
|---|---|
| Email bodies never rise above metadata; a source’s content is read once and never stored | Customer Terms of Service 7.2, 7.3; Privacy Policy 4 |
| No automatic send, on any surface | Customer Terms of Service 8.2; Privacy Policy 6.2 |
| Every generated text says so; a score is support, never a verdict | Customer Terms of Service 8.3, 8.6; Privacy Policy 6.3, 6.6 |
| No training on customer data by any model provider; the retention position per provider | Customer Terms of Service 8.4, 8.7; Privacy Policy 6.4, 6.5; the AI Provider Register |
| Never sold, never shared across customers | Privacy Policy 5.8; Data Processing Agreement 7.2 |
| Deletion within thirty days; export for thirty days after termination; backups ninety days | Privacy Policy 11 |
| Breach notice to customers, authorities and individuals on every clock that applies | Privacy Policy 12.6; Data Processing Agreement 3.7 |
| The technical and organizational measures, by control | Data Processing Agreement Annex II |
| What the customer runs on its side | Customer Terms of Service 2.6a; Data Processing Agreement Annex IV |
| Availability target and support | Support and Availability |
9. The standing obligation
Every statement on this page is true on the day it publishes and stays true afterwards. When the program changes, this page changes with it, in the same release or before it. A page that describes controls itogai no longer runs is not out of date; it is inaccurate, and itogai treats it as a defect of the same severity as a broken service.
Changelog
Amended October 9, 2026, version SEC-2026-10-09 v5.1. Section 1 now carries the two dates that version 5.0 left as placeholders: the issue date of the current CASA Letter of Validation and the date of the first quarterly access review. Nothing else on this page changed.
New in this release. This page did not exist before September 21, 2026. It was added under Constitution Part 37 so that the answer itogai gives on every security review exists as a page a reviewer can read before the call.
Document version: SEC-2026-10-09 v5.1. Published at itogai.app/legal/security.
© 2026 Itogai LLC. All rights reserved. itogai, the itogai logo, Trustbound, TrustGraph, TrustRings, TrustReach, and Akai are trademarks of Itogai LLC.