Security

How we protect your data, what you control, and what we don't claim.

Last updated: September 28, 2026

Every holds your contacts, deals, emails and invoices. This page describes how we protect that data. Questions: [email protected].

Where your data lives

Every AI Inc. is a Canadian company. Our database and application servers are in the United States (Supabase, Ohio; Railway, US East and West).
The service providers that process your data are listed at every.ai/subprocessors.

All traffic to Every's app and API is encrypted in transit with TLS.
Your data is encrypted at rest in our database and file storage (AES-256).
Credentials for integrations you connect are encrypted and used only by server-side processes.

Each workspace is isolated from every other workspace by database row-level security.
You can turn on multi-factor authentication for your Every account (an authenticator app, with backup codes) under Manage account → Security.
Production access is limited to a small number of named Every personnel, all bound by confidentiality obligations.
Multi-factor authentication is required on Every's administrative accounts (code hosting, database, hosting, authentication and billing).

Every records changes to your records, deletions, and actions taken through the API, MCP and Every's AI agents, with who did it and when.
Activity history is kept for the life of your workspace, so you can see what changed.

We take a daily backup of the database and keep the last 8, about a 7-day window.
There is no point-in-time recovery.

You can permanently delete People, Companies and Deals in the app, through the API and MCP, and with API keys that carry a delete permission.
After deleting a Person, redact_person_history removes their name and email from your activity history. You can run it again later to cover anything recorded since.
When you delete your workspace, we delete its data.
Deleted data stays in our encrypted backups for up to about 7 days, then is overwritten.

CSV export in the app: invoices, expenses, financial reports and time.
People, Companies, Deals and anything else in your workspace: ask the Every assistant for an export, or use the API or the Every CLI with an org API key.

AI-assisted features send the content needed for the task to the AI providers on our subprocessor list.
Those providers process it under paid API terms that do not allow training on it, and Every does not use your data to train AI models.
Enrichment, prospecting and automated outreach run only when you turn them on.

We notify affected customers without undue delay, and no later than 72 hours after becoming aware of a personal data breach affecting their data.

Every change goes through automated tests, and reaches production only after it is verified on a staging environment.
Every's application passes Google's Cloud Application Security Assessment (CASA) at Tier 2 every year, assessed by TAC Security, a Google-authorized lab. That's required to access Gmail and other restricted Google data. Assessment details are available on request.
We do not hold SOC 2 or ISO 27001 certification, and have not had a third-party penetration test.
We answer one security questionnaire per customer per year.