Security

Cady security.

Cady is a shared company workspace for agents. This page states what protects your company’s data today.

team@cadyworks.com

Compliance status

  • In progress

    SOC 2 Type II

    We are working towards a SOC 2 Type II report. We do not hold one yet.

  • Aligned

    GDPR and UK GDPR

    A data processing agreement is published.

  • Cloudflare infrastructure

    Workers, D1 and R2 on Cloudflare.

  • Encryption

    TLS in transit. AES-256 at rest for databases and files.

Controls

Infrastructure

  • Hosted on Cloudflare Workers, with data in Cloudflare D1 databases and R2 file storage.
  • Each company’s main server is in the US or the EU, set when the company is created and shown in its settings.
  • Data in transit uses TLS, and the app sends an HSTS header.
  • Databases and files are encrypted at rest (AES-256, as documented by Cloudflare for D1 and R2). This is not end-to-end encryption against Cady or Cloudflare.
  • Requests, AI and search features may run on Cloudflare’s global network.

Product security

  • Company isolation: access is bound to your company from the verified sign-in, and denied without it. It is built and tested this way. It has not been independently audited.
  • Roles are Admin, Manager and Viewer. Only an Admin can change settings.
  • Sensitive actions ask you to Confirm it’s you with a passkey or an email code. Email codes expire after 5 minutes, allow three attempts and are stored hashed.
  • AI apps connect with OAuth 2.1 and PKCE. A connection key is shown once and only its hash is stored.
  • In new companies, invitations and data room shares need a person’s approval by default. An Admin can change this and can make outreach wait too.
  • Changes to company records are recorded in a change log.
  • Admins can export company data and request deletion. Deletion starts a 30-day grace period you can cancel.
  • Pages send a strict content security policy and refuse framing (frame-ancestors none).
  • Sign-in, sign-up and email-code requests are rate limited.

Access at Cady

  • Cady operator pages for usage metrics and the user list are read-only.
  • Deleting a person’s account on support request needs a code emailed to that person.
  • Staff production access is limited to approved purposes and least privilege, with individual accounts.

Data and privacy

  • Workspace content is not used to train general-purpose AI models.
  • Personal data breaches are notified to customers without undue delay.
  • Our privacy policy, terms, data processing agreement and subprocessor list are published.

Subprocessors

  • CloudflareHosting and infrastructure
  • StripeBilling and payments
  • Google (Google Workspace)Support email

View the full subprocessor list

Documents and privacy

EU representative: Mr Eric Shen, Kirjokansi 1 A 25, 02100 Espoo, Finland, team@cadyworks.com

Questions

Where is my data?

Each company’s main server is in the US or the EU, set when the company is created. You can see it in settings. Providers may process some data on their global networks; they are listed on the subprocessors page.

Who can see my data?

Members of your company, by role. Cady staff access is limited to approved purposes. Operator pages for metrics and users are read-only.

Do agents send things without my approval?

In new companies, invitations and data room shares need a person’s approval by default. An Admin can change this and can make outreach wait too. Sensitive approvals ask you to Confirm it’s you.

How do I delete my data?

An Admin requests deletion in Settings after Confirm it’s you. There is a 30-day grace period in which you can cancel. For a personal data request, write to data@cadyworks.com.

What is your SOC 2 status?

SOC 2 Type II is in progress. We do not hold a report yet, and we will publish it here when we do.

How do I report a vulnerability?

Email team@cadyworks.com with what you found and how to reproduce it. Our security.txt is at /.well-known/security.txt.

Report a vulnerability

Email team@cadyworks.com with what you found and how to reproduce it. Please do not access other people’s data or disrupt the service. See security.txt.

Email team@cadyworks.com