Trust & Security

Your business runs on OpenSassy — bookings, clients, money. That only works if you can trust us completely.

Every claim below is live in production today. Nothing aspirational.

🔐 Encrypted, everywhere

✓Every connection to OpenSassy is encrypted in transit (HTTPS/TLS) — web, mobile, and the voice line.
✓Your data is encrypted at rest (AES-256) in our EU-hosted database.
✓API keys and secrets live in Google Cloud Secret Manager — never in code, never in the browser.

✓Hard multi-tenant isolation: every request is scoped to your business by a verified token — code can't reach another tenant's data.
✓Every blocked attempt is logged to a security audit trail the founder reviews.
✓Clients can only ever see and change their OWN bookings — enforced in the database query itself, not just the interface.

✓UK/EU data residency (Google Cloud europe-west1 + EU database).
✓Every consent is recorded with timestamp, version, and source — and can be withdrawn any time.
✓Access, rectification, erasure, portability: ask in the app or email privacy@the-sassy.com.
✓Our Privacy Policy, Terms and DPA are public.

✓Sassy never claims she did something she didn't — if a build isn't deployed, she says so. Honesty is written into her instructions, and we treat it as a hard rule.
✓Sassy asks before anything irreversible: payments, deletions, and deployments all stop at a human approval gate.
✓The AI providers we use (Anthropic, xAI, Google) process your data to run the service — under API terms that forbid training on it.
✓We never sell your data. Not to anyone, not ever.

✓Live service status is public — you can check our heartbeat any time.
✓Security issues: security@the-sassy.com — we read it, we answer.
✓This page only lists what is REAL in production today. When we ship more, we add it here — never the other way round.

Questions? security@the-sassy.com · OpenSassy is built by ANDUMA Intelligence Group Ltd, UK.