Your customer list is your business. This page says, in plain words, where your data lives, how it's protected, and the rights you keep — no fine print, no inflated claims. If anything here ever changes, this page changes with it.
GeneralOS runs on established United States cloud infrastructure: our database is hosted by Supabase in its US West region, and our application runs on Render. Connections are encrypted in transit (HTTPS/TLS everywhere), and stored data is encrypted at rest by our infrastructure providers.
Every company's workspace is sealed from every other company's. Access is checked on every single request — a signed-in user from one company cannot see another company's customers, deals, or messages, and our own testing tries exactly that on a regular basis. Inside your workspace, your team has clear roles — Owner, Manager, Employee — and the sensitive areas (money, taxes, team management) are limited to the people you choose.
Passwords are never stored in plain text — only as strong one-way hashes (bcrypt). New team members must verify a one-time emailed code and set their own password before they can use the account. Sign-in attempts are rate-limited, and sessions expire. Even our own backup files exclude password hashes by design: if a backup ever leaked, it would contain no credentials.
A backup that has never been restored is a hope, not a backup. On top of our providers' own backup systems, we pull a full backup of the platform every week and store it off-platform — and we test restoring real data into a fresh workspace. Our first restore drill ran on November 5, 2026, and passed: every record checked came back intact.
Download everything — contacts, pipelines, deals, quotes, tasks — in one click, at any time, in an open format. No exit fees, no hostage negotiations. Cancel any time, and ask us to hard-delete your workspace and we'll do it. We don't lock you in. We don't have to.
We keep the list short, and here it is: Render (application hosting), Supabase (database hosting), Stripe (payment processing — only if you connect payments), and Resend (email delivery — only when email features are enabled for your workspace). That's the whole list. We never sell customer data, and we never use your data to train anything.
We're a young company, and we'd rather tell you that than dress this page up. Our protections above are real and tested by us regularly. Independent third-party security testing is on our roadmap before large-scale rollout, and this page will say so plainly when it's done. If you have a security question — or you run a security review before buying — ask us through the Request Work page and you'll get a straight answer.