Your clients are yours. Your data is yours. Nothing moves without a name on it.

1. How it connects

You connect each account through the platform's own authorization screen (OAuth), per account and, on the agency path, per client. Adella asks for read access to reporting data. Write access, which lets Adella apply a change you have approved, is a separate permission requested only on the channels where changes can be applied and only when you turn it on. Adella never holds your platform passwords. Tokens are encrypted at rest and can be revoked from inside Adella or at the platform at any time.

A mailbox or calendar connection for Adella Account Manager or Adella CRM is made by the user whose mailbox it is, with that user's own authorization. No one else's mailbox is read through it.

2. How data is kept separate

Every customer has a workspace. On the agency path, every client inside the workspace has its own client space with its own connections. Every record in Adella's databases carries the workspace and the client it belongs to, and every query is scoped by both at the data layer, not by the screen you are on. A user's permissions are checked on the server on every request, and a request can never widen its own scope by naming a different client.

Adella's own staff cannot see another company's clients, accounts, findings or decisions in the ordinary course of work. Support access to a workspace needs your permission, is limited to the people who need it, and is logged.

3. How changes are made

No change is made to any account without a person in your workspace approving it. Every approved change is logged with the person, the time, the change, the predicted effect and the measured effect. Changes with more money at stake go to a second approver. Some kinds of change are never applied automatically. On the Automation level you set which kinds of change may run under a standing rule; every change applied under a rule is recorded against the person who set it.

Every figure in a finding is passed through from your account or store data. The writing is generated; the numbers are never. How it works.

4. Who can see what

You decide which of your staff see which clients and what each can approve. Roles are enforced on the server. Permissions can be changed at any time and take effect immediately. Sign-in is with Google or with an email address and a password stored as a salted hash; single sign-on for your own identity provider is available on the Automation level. Every sign-in is recorded.

5. Where it runs, and how it is protected

Adella runs on a managed cloud provider (to confirm) in the United States (to confirm). Traffic is encrypted in transit with TLS 1.2 or higher, and the website carries HSTS, a content security policy and the other standard security headers. Data is encrypted at rest (AES-256 (to confirm)) in the databases, in object storage and in backups. Secrets and tokens are held in a secrets store, not in code.

Production systems are reachable only by the engineers who run them, through individual accounts with multi-factor authentication. Dependencies are kept current and the service is monitored for errors and unusual activity. Backups are taken daily, encrypted, and kept for 30 days (to confirm); restores are tested.

6. Monitoring, logging and incidents

Application errors go to an error-monitoring service with technical identifiers only. Every change to a connected account, every approval, every permission change and every staff access is written to the audit record, which is kept for the life of the workspace and is never edited.

If a security incident affects your data we tell you without undue delay, and within 72 hours of confirming it, with what happened, what data was involved and what we have done. Reports of a vulnerability go to [email protected]. We acknowledge within two working days, we do not take action against good-faith research that stays within the law and does not touch other customers' data, and we credit the finder if they wish.

7. How long data is kept, and what happens when you leave

Connected-account data is kept on a rolling 25 months. Disconnect an account and its data is removed from production within 30 days (to confirm) and from backups when the backup window ends. Disconnect a client and the client's workspace goes with them. Close the workspace and everything goes, apart from the billing records the law requires us to keep. Nothing is retained for our own use. The full retention schedule.

8. Who else handles your data

Hosting, billing, transactional email, error monitoring and AI text and image generation are provided by suppliers under contracts that bind them to the same obligations we have to you, and that forbid the AI providers from training on your data. The list, with what each receives. The platforms you connect are your own providers, not ours.

9. For a procurement or security review

No certification (SOC 2, ISO 27001) is claimed yet. A security pack with the architecture, the data flows, the subprocessor contracts, the access policy and the incident process is available for reviews on the Automation level and for annual contracts; the Data Processing Addendum is available to every customer. Ask for the pack.