Security
Last updated July 17, 2026 · Cyber Dogs AI, Billings, Montana, USA
Command Center handles some of the most sensitive information a business has — your email, calendar, contacts, and finances. Here is a plain-English account of the controls we have in place to protect it. We describe what we actually do; we don’t claim certifications we don’t hold.
Encryption in transit and at rest
All traffic to Command Center is served over HTTPS. The OAuth tokens that let us reach your connected accounts are encrypted with AES-256-GCM before they are written to the database, so they are never stored in plain text.
OAuth-only access — no passwords stored
You connect an account through that provider’s own secure sign-in. You never enter a password or API key into Command Center, and we never see your provider credentials. We receive only scoped OAuth tokens.
Least privilege by design
We request only the permissions a feature needs, and you decide which accounts to connect. Every connection is yours to grant — and yours to take back at any time.
Tenant isolation
Every organization’s data is separated at the database layer using PostgreSQL Row-Level Security, so one organization can never read another’s records.
Human in the loop
The AI drafts, summarizes, and suggests — but never sends, schedules, or changes anything on your behalf without your explicit approval. You review every action before it happens.
Revoke access anytime
Disconnect any account in Settings → Connections. Disconnecting removes the stored tokens for that account, so we can no longer reach it. Shared access to a teammate’s connection can be revoked the same way.
Your data and our AI
Command Center’s assistant is powered by Anthropic’s Claude. When the assistant drafts a reply or summarizes a thread, the relevant content is sent to Anthropic to generate that specific result and is returned to you. Your connected content is not used to train Anthropic’s models or ours, and it is never sold or used for advertising. See our Privacy Policy for the full detail.
Infrastructure and sub-processors
We build on reputable, security-conscious infrastructure providers rather than running our own servers: Supabase for our Postgres database and hosting, Clerk for authentication, Netlify for web hosting and scheduled jobs,Anthropic for AI processing, and Resend for transactional email. Data from providers you connect — Microsoft 365, Google, and GoHighLevel — is used only to power the features you turn on. Each provider is listed with its purpose in our Privacy Policy.
Access control and account safety
Authentication and organization management run through Clerk, and access to your organization’s data is limited to your organization’s members. Within an organization, connections are private to the member who created them unless that member explicitly shares one with a teammate — and shares can be revoked at any time. Administrators manage membership and any shared company accounts.
Our honest posture
Command Center is operated by a small team and is an alpha-stage product. We are engineering-led about security: encryption of credentials, OAuth-only access, database-level tenant isolation, least-privilege scopes, and a human-approval gate on every action the AI can take. We are not currently certified under SOC 2, ISO 27001, HIPAA, or PCI-DSS, and we don’t claim to be. We would rather tell you exactly what we do than imply an audit we haven’t completed.
Responsible disclosure
If you believe you’ve found a security vulnerability, we want to hear from you. Please email security@cyberdogs.ai with the details and steps to reproduce. We will acknowledge your report, investigate promptly, and keep you updated. Please give us a reasonable chance to address the issue before disclosing it publicly, and avoid accessing or modifying other users’ data while testing.