Security & privacy

You trust us with your client inquiries, your proposals, and your mailboxes. Here is where that data lives, who can access it, and what we do with it.

Where your data lives

Your data is hosted in the European Union, in Paris, via Supabase on AWS infrastructure. The application is served by Vercel.

All data is encrypted in transit (TLS) and at rest.

You can check the state of our services in real time on our public status page: status.joinways.app.

Who can read your emails

It's the question we get asked most often: nobody at Joinways reads your emails.

• Gmail, Outlook, and calendar connections go through OAuth: we never see or store your passwords.
• Access tokens are encrypted, and you can disconnect a mailbox at any time.
• Processing is automated: incoming inquiries are extracted by software, not by a person.
• The Joinways team only accesses the content of your data for support, at your request.
• An email sent from Joinways goes out from your own mailbox and shows up in your sent items.

AI and your data

Pulling the details out of inquiries and drafting replies relies on OpenAI and Anthropic, through their APIs. The rules are simple:

• Your data is never used to train their models.
• Only the information needed for processing is sent to them.
• No reply or proposal is ever sent to your clients without your approval. Acknowledgments and follow-ups are sent according to your rules.

Account security

• Strict workspace isolation: each venue only sees its own data. This isolation is enforced at the database level, not just in the interface.
• A role for each job: owner, admin, member, operations, or read-only. Each person can only change what their job covers, and this is enforced in the database, the API, and connected assistants alike.
• Two-factor authentication (2FA, TOTP) available on all accounts.

Payments and signatures

• Payments are processed by Stripe, PCI-DSS certified: Joinways never stores any banking data.
• Proposals are signed electronically through SignatureAPI, in compliance with the eIDAS regulation.

Our subprocessors

Here is the full list, which matches the one in our privacy policy:

Your data belongs to you

• You can export your data at any time.
• If you close your account, you have 30 days to export your data before it is permanently deleted.

GDPR and contact

Under the GDPR, you have the rights of access, rectification, erasure, and portability over your data. A DPA (data processing agreement) is available on request at privacy@joinways.app.

For the full legal details, see our privacy policy.