Last updated June 2026
How Allign secures the personal data it processes, and what happens if a breach is detected.
In transit: TLS 1.2+ for every public connection (Caddy + Let's Encrypt). HSTS is set for the platform host.
At rest: third-party API credentials (Twilio auth tokens, OAuth refresh tokens, encrypted Meta access tokens, OpenAI keys, Higgsfield bearers, etc.) are stored AES-256-GCM with a scrypt-derived key. The encryption key is held in a server-side environment variable, never in the database.
Call recordings sit on Twilio's storage in the workspace's own Twilio account; the platform only stores the URL + transcript.
The platform is fronted by better-auth (email + password, optionally Google SSO). Sessions are 30-day rolling cookies (HttpOnly, Secure, SameSite=Lax).
Workspace data is segmented by workspace_id; every server action and API route checks the active workspace and role (admin / member / viewer) before reading or writing.
Operators can rotate their own credentials, sign out other sessions, and self-export or self-delete their account at /account/privacy.
See the Privacy Notice for the full list of named sub-processors and the contractual basis under which each one processes data on behalf of Allign.
Application logs are kept on the host filesystem for a rolling 30 days (systemd journal + /var/log/funnels-builder.log). Logs exclude bodies of follow-up emails and contents of call recordings; they include event types, request IDs, and operator IDs for traceability.
Failed login attempts, password resets, and API-key uses are recorded so unusual patterns can be investigated.
A nightly encrypted backup of the SQLite database is taken and stored off-host. Backups are retained on a rolling 14-day schedule and inherit the same per-workspace retention rules. When a workspace shortens its TTL, the next backup reflects the purge.
If we become aware of a personal-data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (Article 33 GDPR).
Where the breach is likely to result in a HIGH risk to those rights and freedoms, we will also notify affected individuals without undue delay (Article 34 GDPR).
If you are a customer of Allign processing personal data through the platform on behalf of your own end-users (you are the controller, we are the processor), we will notify you of any breach affecting your data without undue delay so you can meet your own Article 33 obligations.
Reports of suspected security issues: hello@allign.agency. We aim to acknowledge within one working day.
Researchers are welcome. Please email hello@allign.agency with a description of the issue, steps to reproduce, and the impact. We commit to: (1) acknowledging your report within one working day; (2) giving you a status update within seven days; (3) not taking legal action against good-faith research that doesn't access more data than necessary to demonstrate the issue.
This is a general template, not legal advice. The operator is responsible for completing the details and ensuring it meets the requirements of their jurisdiction.