Security & data handling

Define the task, permitted data and connected accounts, the actions that need human approval, and when work must stop or escalate. For standard front-office work, client-facing actions require your team's approval. Approval alone does not make sensitive work suitable for automation.

Hosting, connected tools and model providers depend on the agreed deployment. The website controls below are not a description of every customer's agent setup.

• Storage before acceptance. Contact and assessment forms require a successful write to private Vercel Blob storage before accepting a submission. If that write fails, the form returns an error rather than claiming the enquiry was saved.
• Server-side access checks. The lead-reading API uses private storage access and sits behind a server-enforced, shared-password login. Protected APIs reject unauthenticated requests; public submission endpoints remain open. This is not a per-person staff permissions system.
• Copies used for follow-up. After storage, the website attempts CRM and email delivery. Enquiry details can also appear in operational logs and failure notifications. Private storage does not mean the submission exists in only one place.

When configured, the website's workflow assessment sends your name and the business, workflow, tools and bottleneck details you supply through OpenRouter to the selected model provider. If AI generation is unavailable, it uses a template instead. The contact form does not run this assessment step.

Keep initial enquiries high-level: do not submit passwords, client files or confidential financial or privileged material. For a deployment, confirm the actual provider, processing region and contractual terms before sharing sensitive data. We make no blanket zero-retention, no-training or certification claims.

This marketing website uses analytics and advertising measurement, including session replay. These are distinct from the model processing used to generate an assessment and from a customer's connected workflow. The Privacy Policy explains the providers, regional consent rules and cookie settings.

Use these questions to agree requirements before setup. They are not a list of built-in controls or promises that every deployment has the same capabilities.

• Staff and support access: who may view data, administer accounts and approve actions, and which permissions each person needs.
• Providers and regions: where processing happens, which services receive data, and which retention and model-training terms apply.
• Retention, backups and deletion: what is kept in each system, for how long, who can request deletion, and how backups are handled.
• Logging: which actions and data need to be recorded, who can inspect those records, and how long they should be retained.
• Incidents and escalation: who receives concerns, when the workflow should pause, and how your team is contacted.
• Revocation and handover: how to disconnect tools, revoke credentials and access, and return or delete data when work ends.

Send security questions or report a concern to hello@33labs.ai. Describe the issue without including credentials or confidential client material.

To discuss a workflow and its requirements, contact us.