Security and Sub-processors

How Content OS handles your data

Content OS is not connected to your CRM, your client or prospect records, your custodial data, or your financial planning data. We do not receive them and we cannot access them. The source material we use to produce your content is publicly available information — principally your own website — together with our own research datasets.

The data we do hold on your behalf is limited to your portal accounts: the names, business email addresses and roles of the people at your firm who use the platform, their credentials in hashed form, and a record of what each of them approved and when.

Where you connect your website, social accounts or email platform, we hold credentials that let us publish approved content into those systems. Those credentials are stored encrypted and used only on our servers. Disconnecting in the portal revokes the authorisation with the provider and deletes the credential immediately; if you remove our access in the provider's own settings instead, we delete the credential when we detect it, normally within 24 hours.

Where you connect an email service provider, we create draft campaigns in your own account for you to review and send — we do not send to your subscribers and we do not take custody of your list.

Security measures

• Each firm's data is scoped to its own tenant by access controls enforced at the database layer. Portal users can reach only their own firm's data.
• Individually provisioned portal accounts, revoked on request or on termination.
• Credentials and tokens for your connected systems are stored encrypted, with access limited to House of Work personnel who need them.
• Encryption in transit throughout, and at rest where the underlying platform provides it.
• Multi-factor authentication on our administrative accounts for the platforms that store your data at rest (Supabase and Webflow).
• Source control and change review for the portal codebase.
• We notify you without undue delay, and no later than 72 hours, of any confirmed security incident affecting your data or the credentials we hold for you.

Generative models

We use third-party language models to research and draft content, routed through OpenRouter. Our routing is configured for zero data retention: providers do not retain submitted data beyond the duration of the request and do not use it to train models. Because your client data never enters Content OS, it is never sent to a model provider.

Sub-processors

These are the third parties that process personal data on your behalf in providing Content OS. We give at least 14 days' notice — by updating this page and emailing the address on your account — before adding or replacing a sub-processor that handles personal data. If one has to be replaced urgently for security or continuity, we make the change straight away and tell you as soon as we reasonably can.

• Supabase — Application database and authentication. Data processed: Portal account data; approval records; encrypted connection tokens
• Webflow, including Webflow Cloud — Portal hosting and website publishing. Data processed: Portal account data in transit; content published to your site
• Cloudflare — Network and edge delivery for the portal. Data processed: Portal account data in transit
• n8n Cloud — Workflow orchestration. Data processed: Data in transit through content workflows
• OpenRouter and routed model providers — Content generation and review. Data processed: Content briefs and drafts
• Resend — Portal and transactional email. Data processed: Portal user name and email; delivery events
• Ayrshare — Publishing to the social accounts you connect. Data processed: Social account identifiers; content published

If a firm elects our optional managed email add-on, under which we send on its behalf, we name the email sending provider to that firm before the add-on starts.

Tools that don't process your data on your behalf — such as keyword research and image generation, and the systems we use to run our own business — aren't sub-processors and aren't listed here.

International transfers

Our sub-processors may process data in the United States. For firms in the European Economic Area, the United Kingdom and Switzerland, our Data Processing Agreement incorporates the EU Standard Contractual Clauses, with the UK Addendum and the Swiss adaptations, and we rely on each sub-processor's Data Privacy Framework certification or standard contractual clauses for onward transfers.

Questions

Questions, or a due-diligence questionnaire to complete: team@houseofwork.agency