Your conversations are yours.
Decisions worth recording often live in sensitive conversations. Here is exactly how Withose handles them - what we store, what we never store, and how it is protected. No claim on this page goes further than the code does.
We never see your workspace's messages wholesale
Withose never continuously ingests or indexes your Slack or Microsoft Teams history. There is no message firehose: we do not subscribe to your chat platform's event stream, and we do not sync or index your channels. Messages enter Withose only when a person on your team explicitly captures them: they run a command or click a message, review exactly what was found in a picker, uncheck anything that does not belong, and submit. Only those reviewed messages are stored, and long messages are truncated at capture time.
Captured conversations are encrypted at rest, per workspace
The content of captured messages, verbatim quotes attributed to your teammates, and in-progress capture drafts are encrypted with AES-256-GCM before they are written to our database. Each workspace has its own data key, and data keys are themselves stored encrypted by a master secret that lives in our runtime environment, never in the database. A stolen database, backup, or disk yields ciphertext without the keys to read it.
Deleting your workspace destroys the key
Because each workspace has its own encryption key, deleting a workspace deletes its key. Ciphertext without a key is unrecoverable, including in older backups. Deletion is cryptographic, not just a database row removal.
In-progress captures expire automatically
When you search for context, candidate messages are held briefly so you can review them. These drafts are encrypted like everything else and are automatically purged after 48 hours. Withose keeps what you chose to keep, not what you looked at.
Our own staff tooling never shows your content
Withose's internal admin tools operate on metadata only: counts, dates, plan and connection status. They do not select message text, quotes, or decision questions from the database, and every administrative action is recorded in an append-only audit log.
AI processing, plainly stated
Drafting a decision card sends the messages you selected to Anthropic's Claude API over TLS. Anthropic does not use API data to train its models by default. We send only what you captured, per request, and we do not operate any training pipeline on your content.
What we can and cannot promise
Honesty matters more to us than a bigger claim: Withose is not end-to-end encrypted, because our servers must briefly decrypt content to render your decision pages and run AI drafting. What we promise is that your content is encrypted in transit and at rest, keys are managed separately from data, our tooling is built so staff do not see your content in normal operation, and this page changes when the implementation does. For teams that need customer-held keys, that is on our roadmap for the enterprise plan.
Questions about security, or need a specific answer for a review? Email hello@withose.com and you will get an engineer, not a form letter.