Security and your data.
Where your data goes, what we keep, who can see it, how long we keep it, how it is deleted, and how to report a problem.
Last updated October 8, 2026
Where each kind of data goes.
Five kinds of data, and for each one: whether it leaves your browser, whether it reaches an AI model, whether we store it, and for how long.
Original export
The CSV file you export from QuickBooks Online or Xero for the look-back.
- Leaves your browser
- No. It is read in your browser, and only a fingerprint of the file is sent.
- Reaches an AI model
- No.
- Stored
- No.
- Kept
- Never kept.
Standard-format records
Each bill, payment and credit, mapped into one format so the checks can run.
- Leaves your browser
- No, for a file. If you connect QuickBooks Online, our server builds them in memory for that one check and sends the results to your browser.
- Reaches an AI model
- No.
- Stored
- No. Vendor names, bill numbers and memos are not stored.
- Kept
- Never kept.
Review record
The totals of each audit run, the status of each finding, and each payment decision.
- Leaves your browser
- Yes, to our database.
- Reaches an AI model
- Payment review lines, only when you ask Augustine a question about the run.
- Stored
- Yes, as set out under What we keep.
- Kept
- Until we delete it by hand, when access ends or when you ask.
Uploaded documents
Files you add to your company's data room, and Excel workbooks you send for review.
- Leaves your browser
- Yes, to our servers and to Augustine's document engine, which indexes them for your company.
- Reaches an AI model
- Passages that bear on a question can be sent with that question.
- Stored
- A text copy of each data-room document, up to 12,000 characters. Workbooks are not saved in our database.
- Kept
- Until we delete it by hand, when access ends or when you ask.
AI request
Your question, the earlier turns of the conversation, our instructions, and the context put together for the question.
- Leaves your browser
- Yes, from our servers. Your browser never calls an AI provider.
- Reaches an AI model
- Yes, only to a model that keeps none of it. With none available the request is refused.
- Stored
- The question and the answer, up to 1,500 characters each, or a placeholder when the question used your company's private data. Call details such as the model and length, never the content.
- Kept
- Until we delete it by hand, when access ends or when you ask.
What leaves your browser.
- The look-back reads your export in your browser, and the file never leaves it.
Details
- What is sent is a fingerprint of the file, a summary of the run, and each status you set on a finding.
- Documents you upload, questions you ask, and decisions you record are sent to our servers over an encrypted connection.
- If you connect QuickBooks Online, our server reads twelve months of bills, bill payments, purchases and vendor credits from it, read only, and nothing in QuickBooks is changed. It reads them when you run a check or open the look-back, and when Intuit tells us one of them changed.
- Your browser keeps your sign-in session, the company you selected, and any Slack message you are still drafting.
What reaches an AI model.
- SableAlpha never trains models on your data.
Details
- Requests go from our servers, never from your browser.
- A request carries your question, up to eight earlier turns of the conversation, our instructions, and the context put together for it, such as the payment run on screen, passages from your documents, or the key, summary, status and assignee of Jira tickets.
- Look-back findings and the transactions read from QuickBooks Online are never sent to a model.
- Payment review runs on practice data today, so no company's payment run has been sent.
- A request that carries your company's data goes only to a model that keeps none of it, and when none is available the request is refused rather than sent elsewhere.
- Questions to Augustine's document engine, which answers from your data room, are not yet held to that rule.
- Other requests, such as those about public market data, may go through a third-party AI routing service to the model chosen for the task, and the current list of providers is available from privacy@sablealpha.com.
What we keep, and why the export is not part of it.
- We keep totals and statuses from a review, never your export or the transactions in it.
Details
- The promise that your export is not stored is about the file and the transactions in it. To show what a check found and what was done about it, we keep a review record: totals and statuses, not transactions.
- Each audit run: where the data came from, the period it covers, how many rows, bills, payments and credits it held, how many findings it raised, the amounts at risk by rule, and a fingerprint of the file.
- Each finding: the rule, the amount at risk, its status, any amount recovered or refunded and when, and who changed it and when.
- Each problem found as it happened in QuickBooks Online: its fingerprint, the rule, the amount at risk, and when it was found and emailed. The email goes to whoever connected QuickBooks and names the rule and the amount, never a vendor or a bill number.
- A finding is named by a fingerprint of its date, vendor, bill number and amount, so it can be matched to your books without our holding them, and someone who already knows those details could confirm a match.
- Each payment review: the company name, the date, the number of lines and the total, and for each line the decision, the amount, the approvers' names, the reason given for an override, the payment's date, amount, reference and payer, and the outcome.
- Every decision on a line is kept, with who made it and when. An undo or a later decision is added to the record, never written over it.
- Uploaded documents: a text copy of each, up to 12,000 characters, and the passages cited as evidence for an action you approved in Slack, Jira or Excel.
- Questions to Augustine: the question and answer, up to 1,500 characters each, or a placeholder when the question used your company's private data, such as a payment run.
- Connections: QuickBooks Online sign-in tokens, encrypted with a key kept outside the database; your Jira site, sign-in token and the synced tickets' key, summary, status, type, priority, assignee and link, never descriptions or comments; and the address of the Slack channel you connect.
- Security events, such as sign-ins and connection changes, which never carry passwords, tokens, prompts or content.
Who can see it.
- SableAlpha creates every account, and there is no public sign-up.
Details
- A company's workspace is open to accounts at that exact email domain, or to a design partner account we assign to it. A different domain or subdomain is a different workspace.
- Roles within a company are not yet enforced, so anyone with access to the workspace can record a decision.
- Jira and Slack connections belong to the person who made them.
- SableAlpha's founders can open any company's workspace to support it. That needs a second sign-in step, and each request is recorded in our audit log, which the company cannot see yet.
- The database is reached only from our servers, never directly from a browser.
- Multi-factor sign-in is available, and once you turn it on every request needs it.
How long it is kept.
- Review records, document text, conversations and connections are kept until we delete them by hand, when access ends or when you ask, and nothing is deleted automatically yet.
Details
- The original export and the standard-format records are never kept, so there is nothing of theirs to expire.
- A compliance run saves the payment snapshot as sent on the temporary disk of the engine server that runs it, not encrypted with your company's own key, until our host shuts that server down.
- The run's trace is returned and not kept, and nothing from the run is written to a database.
- The rule steward keeps each finding the judge dropped, with its rule and a reason of up to 300 characters, and the rule packs the run mapped, in that server's memory and temporary disk until it shuts down.
- Design partner access ends on the date agreed, after which sign-in is refused, and we then delete your company's data by hand and confirm in writing when it is done.
- Billing records and security events are kept longer to meet legal obligations, and deletion from backups is not immediate.
How deletion works.
- Write to privacy@sablealpha.com and we delete your company's review records, document text, conversations and connections by hand, then confirm in writing when it is done.
Details
- Deleting your account in the app removes the account, its saved conversations and its personal data, and your company's records are deleted through the written request above.
- Disconnecting QuickBooks Online revokes its access at Intuit and deletes the stored tokens, and disconnecting Jira deletes the connection and the synced tickets.
- Security events and billing records are kept after a deletion.
How it is protected.
- 01
Encryption
Data is encrypted in transit with TLS and at rest with AES-256 by our database host, and QuickBooks Online tokens are encrypted again with a key kept outside the database.
- 02
Logs
Operational logs carry metadata only, never passwords, tokens, prompts, or content.
- 03
What we do not claim
This page makes no claim of certification or complete security.
Report a vulnerability.
- Can I test against your live systems?
- Not without written permission. Describe what you saw instead.
- Is there a bounty?
- No. We read every good-faith report and reply.
- Good-faith security reports are welcome at security@sablealpha.com, a monitored mailbox.
Details
- Please include reproduction steps and avoid privacy violations, data destruction, or service degradation.
- SableAlpha does not currently publish a safe-harbor statement, so testing against live systems is not authorized without written permission.
- SableAlpha runs no paid bug bounty and makes no promise of payment.
Questions about this document go to hello@sablealpha.com, and the other policies are linked in the footer.