Security & privacy
Last updated: July 29, 2026
You trust us with your client inquiries, your quotes and your email inboxes. This page explains, in plain terms, where that data lives, who can access it and what we do with it.
Where your data lives
Your data is hosted in the European Union, in Frankfurt, via Supabase on AWS infrastructure. The application is served by Vercel.
All data is encrypted in transit (TLS) and at rest.
You can check the state of our services in real time on our public status page: status.joinways.app.
Who can read your emails
It's the question we get asked most often, so let's answer it head-on: nobody at Joinways reads your emails.
- Gmail, Outlook and calendar connections go through OAuth: we never see or store your passwords.
- Access tokens are encrypted, and you can disconnect a mailbox at any time.
- Processing is automated: software extracts incoming inquiries, not a person.
- The Joinways team only accesses the content of your data for support, at your request.
- An email sent from Joinways goes out from your own mailbox and shows up in your sent items.
AI and your data
Inquiry extraction and reply drafts rely on OpenAI and Anthropic, through their APIs. The rules are simple:
- Your data is never used to train their models.
- Only the information needed for processing is sent to them.
- Nothing is ever sent to your clients without your approval.
Account security
- Strict workspace isolation: each venue only sees its own data. This isolation is enforced at the database level, not just in the interface.
- Two-factor authentication (2FA, TOTP) available on all accounts.
Payments and signatures
- Payments are processed by Stripe, PCI-DSS certified: Joinways never stores any banking data.
- Electronic signature of quotes is eIDAS compliant, via SignatureAPI.
Our subprocessors
The full list, identical to the one in our privacy policy:
| Subprocessor | Role |
|---|---|
| Supabase (AWS) | Hosting and database (EU, Frankfurt) |
| Vercel | Application delivery |
| Stripe | Payments |
| SignatureAPI | Electronic signature |
| Resend | Transactional email delivery |
| OpenAI | AI processing (extraction, drafts) |
| Anthropic | AI processing (extraction, drafts) |
Your data belongs to you
- You can export your data at any time.
- If you cancel, you have 30 days to export your data before it is permanently deleted.
GDPR and contact
Under the GDPR, you have the rights of access, rectification, erasure and portability over your data. A DPA (data processing agreement) is available on request at privacy@joinways.app.
For the full legal details, see our privacy policy.
A question about security or your data? Write to us at privacy@joinways.app