Security & trust
Your data, your machine, your rules.
Your AI team touches your ad budgets, your listings and your customers' data. Here is exactly what it can and can't do, where your data lives, and what happens if you ever leave. Written for a founder, not an engineer.
| When | What changed | Proposed | Approved |
|---|---|---|---|
| 09:04 | Meta · Duvet-03 budget $400 → $625/day | Johnson | Sarah |
| 09:04 | Meta · paused 3 ad sets under 1.6× | Johnson | Sarah |
| 10:25 | Amazon · Queen Sheet Set price $34.99 → $33.79 | Johnson | Maya |
| 14:06 | Meta · 6 new ads live in the testing campaign | Johnson | Maya |
| 11:20 | Growth Dept · Growth lead signed in · Meta connection renewal | Growth lead | Sarah |
| 16:40 | Klaviyo · welcome email test B sent to 50% | Johnson | Sarah |
Eleven promises
What we promise every brand we run.
An AI that touches ad budgets and customer data has to earn it. These aren't policies in a drawer; they're how the machine is built.
Nothing changes without your approval
Your AI team proposes in Slack with before and after. Nothing touches your ads, listings, prices or emails until you tap Approve, or until you've set limits it must stay inside. Approval always comes from someone on your team; your growth executive never approves for you. Your ad accounts stay yours: your AI team is a user on them, never the owner, and you can remove it from any platform in one click.
A record of every change
Who proposed it, who approved it, what it was before and after, and when. The record can't be edited or deleted, and you get an hourly summary.
Your data lives on your machine, in your office
Every number from every store, marketplace and ad account is kept on the machine we built for you. Not in our cloud. Not on our laptops. For the first thirty days the machine sits with us while we connect everything; it is still your machine and your accounts, and it ships on Day 30.
Nobody trains on your data
When your AI team or Claude works on a question, only the figures that question needs go to the AI provider, under an account in your company's name, on business terms that rule out training and keeping. Customer names never cross. Nothing goes to Growth Dept.
Claude can read, never change
When your team asks Claude about the business, it can only look. Changes still go through your AI team and your approval.
You decide who can ask what
Finance can see margins; a new hire can't. Anyone not on your list gets no answer at all — not a partial one.
Backups you can restore
Your data is backed up every night and we test a restore every week, so a backup is something that works, not something that exists.
Private access only
Your machine isn't reachable from the public internet. Your team gets in through a private connection; nobody else gets a door to knock on.
Our key is your switch
After Day 30 we hold no standing key. When your AI team needs a hand from us, you grant access from Slack for that job, every sign-in by us lands in the change record with a name and a reason, and it switches off when the job is done. One message turns it off early, and it stays off.
Everything is yours if you leave
The machine, your AI team, your data, your playbooks and your Slack app stay with you and keep running. We hand over the manual.
Where a question goes
The honest version: the numbers a question needs do leave the machine for the AI, under your own account. Customer names never do.
01
Your machine
Every number, every customer record. Stays here.
02
The AI provider, under your account
Sees only the figures the question needs. Business terms: no training, nothing kept.
03
The answer, in Slack
Back to the person who asked. Nothing goes to Growth Dept.
Customer names, emails and addresses never cross. The machine strips them out itself, and we test that every six hours.
If the machine fails, your ads keep running
A replacement ships with your last backup on it, and your growth executive is on the phone until it arrives.
01
Backed up nightly
Every number, every playbook, every change record.
02
Replacement ships
With your last backup already on it.
03
Ads keep running
At their last approved budgets. Nothing changes without you.
The first thirty days
Before it reaches your office, it is still yours.
For one month the machine sits with us while everything is connected. Here is what protects it during exactly that window.
01
Where it sits
On our desk, in our office, for thirty days. It is your machine and your accounts the whole time.
02
Its disk is encrypted
Powered off, it is a brick to anyone without the key. It is already behind the same private connection your team will use.
03
Every connection is yours
Made under your own store, marketplace and ad accounts, so you can cut any of them from the platform side at any moment.
04
The record runs from day one
The same change record, from the first sign-in. The Day 30 hand-off includes who touched it and when.
How a change happens
Propose. Approve. Go live. On the record.
Every change to your ads, listings, prices or emails takes the same four steps. There is no shortcut, for your AI team or for us.
- 1 / 4
Your AI team proposes
In Slack, with before and after.
- 2 / 4
You approve
One tap. Or skip it.
- 3 / 4
It goes live
Inside the limits you set.
- 4 / 4
It's on the record
Who, what, when — kept forever.
The details
For your technical person.
Eight things they'll want to know, in plain words. Ask to see any of them on the install call.
Approval gates on every money-moving action
Ad budgets, bids, prices, listing edits and customer emails are previewed with old and new values, approved by a named person, and refused if the target changed in between.
An append-only change log
Every approved change writes a record that can't be edited or deleted, and an hourly summary of every change on every ad platform — ours, yours or an agency's — posts to Slack.
Customer names never reach the AI
Your AI team and Claude only ever see numbers with names, emails and addresses stripped out. The machine enforces that rule itself, not a policy document, and we test it every six hours.
Nightly backups with weekly restore tests
Everything on the machine is backed up every night, encrypted. Once a week a backup is restored and checked, and the recovery steps are written down.
No door from the public internet
Your machine cannot be reached from the open internet. Your team gets in through a private connection with two-step sign-in, and the short list of who can get in is checked and re-applied every time the machine starts.
Your own AI accounts and billing
Your AI team and Claude run under AI accounts opened in your company's name, on business terms that rule out training. Software subscriptions and AI usage are additional costs, billed directly to you by the providers. The AI sees the answer to each question, never your whole set of records.
No cloud to certify
There is no Growth Dept cloud holding your data, so there is nothing of ours to audit. Your records stay on a machine in your office; the only thing that leaves it is the figures a question needs, sent to the AI under your own account with names stripped out. We will sit with your security lead and show every control on this page.
Our access is granted per job and on the record
After Day 30 we hold no standing key. When a job needs us, someone on your team grants access from Slack for that job; every sign-in by us is written to the same change record with a name and a reason, and access ends when the job does. One message ends it early.
Next step
Forty-five minutes with our team. Your AI team in your Slack a week later.
Bring your store URL and the numbers you already trust. You'll leave with a written plan: what your AI team takes on first, what it costs, and when it's in your Slack.
- Johnson
- Nova
- Emily
- Carley
growth-dept
Your department's first week. Roles are examples.