How is our pack's data protected?

Three principles drive how we handle workplace data:

1. The honest view, not the surveilled view

Managers and admins never see who said what in a pulse or check-in. They see the distribution — the shape of the room. The only person who can read a packmate's individual mood log is that packmate.

2. Encrypted everywhere

• In transit: TLS 1.2+ on every request, HSTS preload
• At rest: AES-256 on the database
• Client storage: localStorage for non-sensitive UI state only; auth tokens use httpOnly cookies

3. You own the data; we just hold it

• Export-on-request is in your settings
• Deletion-on-request is in your settings (and binding for us within 30 days)
• We never sell, share, or use workspace data to train models

Where to read more

• /security — full security overview, sub-processor list, incident process
• /privacy — the privacy policy itself
• /trust — security posture, certifications in progress, how we think about this

If you have a specific question for your security team, hello@thebetterusproject.com gets you a real human within a day.