Security

Your data

• It's kept in the UK and the EU, on infrastructure that encrypts it at rest. Everything between your device and Heedkin is encrypted in transit, and browsers are told to use HTTPS only.
• The keys Heedkin uses to reach your connected apps are encrypted again by us before they're stored. They're never sent to your device or shown to an AI model.
• We don't sell your data or use it to train AI models, and the AI providers we use don't train on it either.
• Deleting your account deletes your data straight away, and withdraws Heedkin's access at each app you connected.

Signing in

There are no passwords to steal or reuse. You sign in with a link sent to your email or with a passkey on your device. Deleting your account needs a sign-in from the last few minutes, so a session left open somewhere can't do it.

Connected apps

Each app connects through its own sign-in page, so Heedkin never sees your password for it. We ask for read-only access unless a feature needs more, and you can disconnect any app from Settings at any time. Notifications from apps are checked to be genuine before Heedkin acts on them.

What agents can do

• Agents ask before they send, change or delete anything, unless you've said a kind of action is fine. You can change that for each kind of action, or say never.
• Agents can't move money or make payments.
• Text from outside, such as an email or a webpage, is marked as untrusted. Agents treat it as information, never as instructions, and it can't change what they're allowed to do.
• Every action an agent takes for you is recorded with your answer to it.

Reporting a problem

If you think you've found a security problem, email hello@heedkin.com with what you found and how to reproduce it. Please give us a chance to fix it before telling anyone else, and only test against your own account: don't access other people's data or disrupt the service.

Our contact details are also in heedkin.com/.well-known/security.txt.