1) Architecture & data flow

• Your workspace: Automations run inside your GHL account; data remains under your control.
• Secrets: API keys stored in encrypted vaults with role-based access.
• AI usage: Model providers process text you approve for generation/analysis; we do not use your data to train public models.

2) Access controls

• Principle of least privilege for staff and automations.
• Separate roles for implementation vs. support; time-boxed elevated access when required.
• Device posture (screen lock, disk encryption) enforced for staff endpoints.

3) Development & change management

• Version control and peer review for automation changes.
• Staging environments for riskier flows before production.
• Rollback plans and change logs for client-visible updates.

4) Incident response

• 24/7 monitoring of uptime and critical jobs.
• Defined runbooks for service disruptions or data incidents.
• Customer notification aligned with legal requirements and best practice.

5) Client responsibilities

• Restrict user access in your GHL workspace to trusted staff only.
• Rotate credentials if team members leave or roles change.
• Review AI outputs as needed for regulated industries (e.g., legal, medical).

6) Questions

Need a security questionnaire or DPA? Contact us via About Tim. We’ll respond promptly.