No training on your data
Your conversations are not used to train models. Temporary chats save no memories at all and delete after 24 hours of inactivity.
Security
Security and trust, in plain language.
What we protect, how we protect it, and what we do not claim. If a security page reads like marketing, it is. This one is an inventory.
The essentials
How your data is handled.
Encryption
TLS for everything in transit, with HSTS. Provider API keys, OAuth tokens, and connector secrets are encrypted at rest.
You can always leave
Full account data export on every plan, conversation export to Markdown and JSON, and real account deletion that revokes tokens and connections.
Sign-in
Email and password with strict rate limits, or sign in with Google and Apple. Sessions are short-lived, and tokens are revoked when your password changes.
Abuse resistance
Layered signup and traffic protection, per-plan rate limits, and webhook signatures with replay windows on every inbound integration.
Hardened surface
Strict content security policy without inline-script allowances, frame and sniffing protections, and security headers across the app.
Memory and keys
Control, visible and revocable.
Memory you can audit
GPTree saves facts, decisions, and patterns, not transcripts, each scoped to account, project, or conversation. The Memory Inspector shows every entry; edit, pin, disable, or delete anything. Automatic memory you cannot inspect is creepy, so ours is inspectable.
Your keys, your bill, your revocation
Bring-your-own keys are encrypted at rest and used only to run your requests. Connector access is per-user and revocable in one click, and write actions through connectors always ask before running.
For organizations
Enterprise-grade controls.
- SAML 2.0 and OIDC SSO with just-in-time provisioning
- Workspace RBAC and per-tool access policies
- Hash-chained audit timeline for agent activity
- Approval gates on write actions and high-risk steps
- Data lifecycle controls: export, deletion, retention
- Signed webhooks with replay-window enforcement
The honest part
What we do not claim.
No SOC 2 report has been issued yet; a readiness program is underway and we will share the controls summary with any prospective customer. If you find a security issue, tell us directly and we will act on it fast.
Get started
Never re-explain yourself.
Start free in under a minute. No card required. Use built-in credits or bring your own keys.