Security and data
What we keep, and what we don't
Registrations and what people choose to tell you are kept; trackers, the text of their emails and readable keys aren't. Each line on this page describes what the product does today.
Kept
- Registrations
- Each person's email address, their name if they give it, their company's domain for a work address, how they came (the way in and any UTM tags), their status, and what they choose to tell you: what they hope to get, questions they send.
- Research on companies
- When you run the lens, the answers about each registrant's company, with their sources. About the company, never the person; personal addresses (Gmail, Outlook…) aren't researched.
- What you set up
- Events, ways in, invitations, speakers, sponsors, posts, images and the brand you set. Your connected keys, encrypted.
- Delivery records
- Which emails were sent to whom, of what kind and whether they went, and which registration emails came in: 13 months. Webhook deliveries, which carry the registrant: 30 days.
- Your account
- Your name, email address and sign-in identity, your team, the Terms you accepted, an audit log of changes, and where your sign-up link came from (first visit only).
Not kept
- The text of emails people send
- A registration or reply email is read to act on it (register, cancel, pass a question to you) and its text isn't kept beyond that.
- Who scanned a code
- A QR scan or link visit counts when, the kind of device and what it opened. No IP address or browser details are kept, and link previews aren't counted.
- Trackers
- No advertising or analytics trackers and no third-party cookies, which is why there's no cookie banner.
- Keys in readable form
- API keys are kept only as a hash. Connected keys and webhook secrets are encrypted and never shown back, in a page, a response or a log.
- Model calls with people's details
- No registrant's name or email goes to an AI model. The writing tools see what you give them; the run of show sees what registrants hope to get, unattributed.
Keys, webhooks and outside pages
Your keys, encrypted
Keys for the services you connect (Luma, Zoom, Eventbrite, programmable.info, your AI provider, your stream) and webhook signing secrets are encrypted by the app with AES-256-GCM, a fresh random IV each time, before they reach the database, using a key the database never holds. They're decrypted only at the moment of the call they're for.
Signed webhooks, to vetted addresses
Each delivery carries an HMAC-SHA256 signature over its timestamp and body, and an id that stays the same across retries. It goes over HTTPS only, to an address checked when connecting (no private, loopback, link-local or cloud metadata addresses, which also covers DNS tricks), follows no redirects, and gives up after 15 seconds.
Reading pages you point at
When you paste a Luma, Eventbrite or Meetup link, a deck or your website, the page is fetched the same guarded way: HTTPS, public addresses only, checked at connect time, a few redirects at most, and size and time limits.
AI on your key, research through programmable.info
Writing (descriptions, posts, the run of show) runs on your own Anthropic or OpenAI key, under your agreement with them. Research on registrants' companies runs through programmable.info on your own key, every answer citing its source; a registrant can turn it off from their page, which deletes what was found.
Links that can't be turned against people
Opening a link never registers anyone
A page, a QR code, an invitation or a reminder link only shows something. Registering takes the person's own tap or their own email, so link scanners and previews can't sign anyone up, and opening an invitation registers no one.
Typing an email reveals nothing
Anyone can type any address into a form, so the form never hands back the person's page: the confirmation, with their personal link, goes to that inbox. The address gets a confirmation it can cancel.
Personal links, kept as hashes
Each registrant's page, each invitation and each speaker kit has its own unguessable link. Only a hash of the token is stored for looking it up (a kit's is also kept encrypted, so you can copy its link again), so the database alone can't produce working links.
Unsubscribing, without a login
Every email to a registrant carries a link and one-click List-Unsubscribe headers that stop email from that host. The link's page changes nothing until its button is pressed; replying "stop" works too.
How long, and how to leave
Registrations stay until you delete them, the event or your account. The rest has a clock.
- Email delivery records and received registration emails: 13 months. Webhook deliveries: 30 days.
- Encrypted database backups: 14 days, so deleted data leaves them within about 15 days.
- Export any event's registrants as CSV, or the whole account as one file from Settings (never with keys, tokens or hashes in it).
- Erase one registrant, or one person across every event; what's left is a hashed opt-out so they aren't emailed again.
- Closing your account keeps it readable for 30 days to export, then deletes it with everything in it.
Subprocessors
The providers that handle registrants' data for you. Account owners get at least 14 days' notice by email before one is added or replaced. The formal list is in the Data Processing Addendum. Billing (Stripe) and error reports (Sentry, with personal data removed first) are our own providers, named in the Privacy Policy.
| Provider | What for | Where |
|---|---|---|
| OVHcloud US | Hosting: the servers and database that run the Service | United States (Virginia) |
| Cloudflare, Inc. | Network: delivering and protecting web pages; receiving registration emails and passing them to the Service | Global network; United States |
| Resend (Plus Five Five, Inc.) | Sending email: confirmations, reminders, invitations and replies | United States |
Questions
Is Programmable Talk SOC 2 certified?
No. We don't hold SOC 2 or another certification, and won't claim one we don't have. This page and the Data Processing Addendum say what we do instead, and we answer security questionnaires by email.
Where is the data?
On servers in the United States (Virginia), with nightly encrypted database backups kept for 14 days. Pages and registration emails pass through Cloudflare's network; email is sent through Resend.
Can I take my data with me, or delete it?
Export registrants as CSV from each event, or everything in your account as one file from Settings. You can erase one registrant, or one person across every event, and closing your account deletes everything after 30 days to export.
Does Programmable Talk pay for or run AI on our data?
No. Research runs through programmable.info on your own key, billed there. The writing tools run on your own Anthropic or OpenAI key. This app pays for no model calls.
Something we should look at? Write to support@programmable.you.