Data and security
Last updated October 15, 2026
The short version. Your tasks are sent to the AI companies that run the models. We keep your account, your billing records and what you choose to save. An account owner can see what each person spends, never what they asked. We don't have a formal security certification yet, and we say so below.
Where your content goes
When you run a task, its text (and any image you attach) is sent to whichever AI company's model is doing the work, for example Anthropic, OpenAI or Google, sometimes by way of OpenRouter. That is how the work gets done, and it is the same for every service that uses these models. Each company's own terms describe how it handles data sent through its API.
We don't use your tasks to train any model.
What we store
- Your account: email address, business name, and a password stored only as a salted, deliberately slow hash.
- Billing: the brand and last four digits of your card, what each task cost, and your payment history. Card numbers are entered on Stripe's own page and never touch our servers.
- For each task: a short title, the type of work, the time, how many model calls it took, and the cost. Not the full prompt and answer: your chat history is kept in your own browser.
- What you choose to save: agents, automations, scheduled tasks and their last result, projects, remembered facts, and files you upload or generate.
Who inside your company can see what
- The account owner sees, for each person, how much they spent, how many tasks they ran, and how often those succeeded. They do not see what anyone asked or what came back.
- Each person sees their own tasks only.
- Removing a person cuts off their access immediately.
How the service is protected
- Keys: the keys for the AI companies live on our server and are never sent to a browser.
- Sign-in: signed, HTTP-only session cookies. Changing a password signs out every other device. Repeated wrong passwords are blocked for a while.
- Limits: rate limits on sign-up, sign-in, running tasks and public forms, and spending limits that stop runaway use.
- Payments: handled by Stripe. A failed charge pauses the account rather than letting a debt grow.
- Backups: the account database is copied automatically every six hours, and the last week of copies is kept.
- The browser feature: runs in a separate, temporary browser that is deleted when it closes or goes idle. If you sign in to a website for an agent, that session is kept only until you press Disconnect.
What we don't have yet
Being straight about this saves you time.
- No SOC 2, ISO 27001 or similar certification.
- No single sign-on (SSO) or automatic user provisioning. People sign in with an email and password, or with Google.
- No choice of where data is processed, and no customer-managed encryption keys.
- No detailed audit log of every action.
If one of these is a requirement for you, tell us. It helps us decide what to build, and we'll tell you honestly if we can't meet it.
Getting your data out, or deleted
Write to modelstack44@gmail.com and we'll send you a copy of what we hold about your account, or delete the account and the data tied to it. The full details are in our Privacy Policy.
Reporting a problem
If you think you've found a security problem, please write to modelstack44@gmail.com with what you saw. We'll answer quickly and won't take action against someone acting in good faith.