Customer Magic

Security & your data

Written for the person
who has to sign it off.

You are about to point something at your inbox, your calendar, your CRM and your billing. That deserves a straight answer about what happens next — including the parts where the answer is “not yet”.

  • Your workspace is the boundary

    Every opportunity, contact and note is owned by one workspace and readable only inside it. That isolation is enforced on every query rather than by a filter someone remembered to add, and it's the single property our test suite checks hardest.

  • Where it lives

    Stored in Frankfurt, Germany (Neon Postgres on AWS eu-central-1), since 11 Oct 2026. Before that day it was in the US (AWS us-east-1). Processed in Frankfurt, Germany (Vercel functions, region fra1), since 11 Oct 2026; before that day in Washington, D.C. Five things happen outside Frankfurt: page delivery and the sign-in check (Vercel's network, nearest the reader), accounts (Clerk, US), payments (Stripe, worldwide), the mails we send you (Resend, US), and model calls for the built-in assistant (place not established).

  • The agent reads; you approve

    Nothing is sent on your behalf without you approving it. Drafts are drafts. Where the setup skill connects your sources it asks for read-only access wherever the vendor offers it — nothing in the workflow needs permission to send an email or move a deal.

  • You connect it, with no password involved

    The connection between your agent and your workspace is an OAuth grant you make yourself. We never ask you to paste a password anywhere, and there is no password of ours to leak. A workspace API key can be revoked in Settings at any time. Withdrawing an agent's grant is not self-serve yet — write to me and I remove it.

  • Admin actions are written down

    Admin actions — changing seats, cancelling the subscription, creating or revoking an API key, removing a colleague — are recorded with who did it and when. So an accident and a bad actor are distinguishable afterwards.

  • No card during the trial

    The 7-day trial is entirely ours — no Stripe customer, no card, no payment method anywhere in the system until you decide to pay. There is nothing to auto-charge because nothing has been collected.

The uncomfortable questions

Answered plainly, including where the answer is no

A security page that only lists strengths tells you nothing, because every security page lists strengths. These are the ones that actually decide whether you can use us.

Are you SOC 2 or ISO 27001 certified?
No. Customer Magic is early and run by one person; an audit that says otherwise would cost more than the company has and would be theatre at this size. If that is a hard requirement for your organisation, we are not the right fit yet and I'd rather tell you now.
Who at your end can see our data?
Ben, and only to fix something you've reported or to keep the service running. There is no support team and no data brokerage of any kind. Every company that handles data for us is listed, with what it sees, on the Trust page.
Does our data train a model?
Customer data is not sold, not shared, and not used to train models. We train and fine-tune nothing on it, and since 11 Oct 2026 every model call is limited to providers that do not train on prompts.
What happens if we leave?
When you end the contract, export first if you want a copy; a download works even after a subscription ends. A workspace is deleted when its admin asks us, within 30 days of the request, with everything in it. Invoices are kept for as long as German tax law requires.
Where do I report something?
Reply to any email from us, or use the contact page. A security report gets answered the same day.
Under the hood

For the technically minded: access control is enforced per request and per workspace rather than in the interface; every route that touches your data authenticates and takes a rate-limit token, and that rule is asserted by tests that read the source rather than trusting a convention. Internal errors are logged and never returned to a caller. Secrets live in the environment, never in the codebase.

The controls are documented in the same commit as the code that implements them — a deliberate rule, because a security document that drifts from the system is worse than none.

Still have a question?

If your team has a security review process, send it over — I'll fill it in myself, and I'll tell you where we don't measure up rather than leaving you to find out.

Ask me directly

See also: every sub-provider, with dates, how it works and pricing.