Security & Trust
Switchy reads your team’s chat and can act on connected tools - so trust is the product. Here is exactly what it does, what it doesn’t, and how it’s built.
Last updated June 8, 2026
What Switchy does
- Keeps each organization’s memory, messages, connections, and secrets walled off from every other org (enforced in SQL, proven by a CI merge-gate test suite).
- Stores connector credentials in a secrets vault (GCP Secret Manager) - never in our database, never in a log, never in a model prompt. A CI guard fails the build if a secret could leak.
- Requires explicit human approval before any side-effecting action (send an email, post a message, delete) - from every surface, even if a message tries to trick the AI.
- Responds only to explicit @mentions, and only reads channels you’ve linked it to.
- Lets an admin pause, revoke, kill, export, and delete - each action audited.
What Switchy never does
- Read a channel it isn’t linked to, your DMs, or another member’s private memory.
- Train any model on your content, or sell your data. Inference is performed by the model providers via OpenRouter under their API terms; the major providers (Anthropic, OpenAI, Google) do not train on data submitted through their APIs by default.
- Send your credentials to a model. The model sees the conversation and the memory it needs - never a token.
- Take a sensitive action on its own. A human approves first.
Credential-injection architecture
Connector credentials live in a secrets vault, not our database. When the bot calls a tool, the credential is injected at the moment of the outbound request and discarded - it is never placed in the model’s context, returned in tool output, or written to a row or log. Each vault reference is bound to its owning organization, so a reference can only ever be resolved within that org.
The approval model
Read actions (search, fetch, recall) run freely. Any side-effecting action - send, post, create, delete, pay - is classified as sensitive and routed to explicit human approval before it runs. This is structural: even a successful prompt injection in channel content cannot trigger a real-world action, because the action still waits for a person to approve it.
Prompt-injection posture
Our defense is structural, not detect-and-strip. All untrusted text - channel messages, tool output, imported history, recalled memory - is wrapped in tamper-evident, provenance-labeled data blocks that the model is instructed to treat as data, never as instructions. A heuristic detector only alerts; it never silently rewrites your content. And because the approval gate sits in front of every side-effecting action, even a prompt injection that the model falls for cannot cause a real-world side effect without a human approving it.
Tenant isolation
Memory, connections, secrets, and messages are scoped per organization, and private memory is scoped to its single owner - enforced at the SQL layer. A consolidated cross-user and cross-tenant leak suite runs as a required CI check on every change; a red test blocks the merge.
Sub-processors
| Sub-processor | Purpose |
|---|---|
| Google Cloud | Hosting, database, secrets (encrypted at rest, AES-256) |
| OpenRouter | Model inference routing |
| Anthropic / OpenAI / Google (via OpenRouter) | Model inference |
| Ably | Realtime message delivery |
| Stripe | Billing (no chat content) |
| Composio | Outbound tool execution |
| Slack | Surface integration - ingests linked-channel + DM content |
| Microsoft (Teams) | Surface integration - ingests added-channel + 1:1 content |
| Resend | Transactional email |
| PostHog / Google Analytics / Amplitude | Product + web analytics |
The full list with each sub-processor's location is in the privacy policy. A signed Data Processing Agreement is available on request - email contact@switchy.build. Switchy notifies you at least 30 days before adding or replacing a sub-processor that handles your data.
On compliance: Switchy's own SOC 2 audit is in progress - we are not yet SOC 2 certified, and we say so. Our infrastructure host, Google Cloud, holds SOC 2 Type II and ISO 27001. The service is built for GDPR/CCPA (EU hosting, DPA, SCCs for US transfers, data-subject rights).
Encryption & data residency
Your data is encrypted in transit (TLS 1.2+) and at rest (AES-256, managed by Google Cloud across Secret Manager and disk). It is hosted on Google Cloud Platform in the EU - region europe-west1 (Belgium). A few sub-processors (OpenRouter, Stripe) are US-based; those transfers are covered by EU Standard Contractual Clauses. Full detail in the privacy policy.
Data retention
Account, chat, and memory data is kept for the life of your account and deleted when you delete it. Deleting an organization opens a 7-day recovery window, then a purge job permanently erases its surface-vault secrets, memory, messages, and chat sessions, then the org record itself. Raw logs and backups containing personal data are purged within roughly 90 days; usage analytics are anonymised after 12 months; billing records are kept up to 10 years as tax law requires. The full per-category windows are in the privacy policy.
Your data: export & deletion
You can view, pin, or permanently delete any memory in-app, and export your data as structured JSON - organization-wide via the admin GDPR export route, which excludes other members' Private memory. Removing a member hard-deletes their Private memory in that org and revokes their API keys and connection tokens atomically. To exercise erasure or portability rights, email contact@switchy.build - we respond within 30 days, per GDPR.
Signed in? See exactly what each connection can see and do.