Is my data secure? How Alignify protects it#
HubSpot access tokens are encrypted at rest and never shown in the app or included in exports. Traffic is encrypted in transit (HTTPS only, enforced with HSTS), and the app sends security headers that block framing and content sniffing. Every workspace's data is kept separate; people only see workspaces they are members of, and roles limit who can change anything: members are view-only, while owners and admins run agents, connect HubSpot, approve HubSpot updates and manage billing. A password sign-in on a new device asks for a code we email you, and you can add two-step verification in Profile & security. Agents read your CRM only to produce the reports you ask for, and HubSpot changes need a person's approval or an admin's explicit automatic-updates switch. The Activity page keeps an audit trail of these actions.
Is my CRM data used to train AI?#
No. Your connected CRM data, the AI prompts and outputs, and your support messages are not used to train AI models.
How AI is used on my CRM data#
Agents use large language models to analyse the HubSpot records you run them on and produce scores, risks and suggested next steps. We use a primary AI provider and a second one only as a backup when the primary is unavailable; both are named as sub-processors in the Privacy Policy at /privacy. Only the data the agent needs is sent, with email bodies shortened to excerpts. AI output is a suggestion for human review; HubSpot changes are applied only with your authorisation: you approve each one, or a workspace admin turns on automatic updates for a specific agent, which can be turned off at any time. For your CRM data you are the controller and Alignify is your processor.
Where is my data processed and stored?#
Our hosting infrastructure and both of our AI providers (the primary one and the backup) are in the USA. For data of people in the EU or UK, transfers rely on the EU Standard Contractual Clauses and their UK equivalent. Product analytics, only if you allow them, are processed by Google (Google Ireland for the EEA and UK). The full list of sub-processors and their locations is in the Privacy Policy at /privacy.
Data Processing Agreement (DPA)#
Alignify offers a Data Processing Agreement for your connected CRM data on request. Ask for a person in the support chat or write to contact@alignifytech.com.
Privacy policy and terms#
The full Privacy Policy is at /privacy and the Terms of Service at /terms. They describe what we collect, the sub-processors we use, how long we keep data and your rights (access, correction, export, deletion). The support chat explains how the product works but cannot give legal advice; for legal or compliance questions ask for a person or write to contact@alignifytech.com.
Analytics and cookies#
Only essential sign-in cookies are always on. Product analytics (Google Analytics) are off unless you click Allow analytics in the cookie banner; they never receive your CRM data, name or email. Change the choice any time in Settings → Privacy (Essential only or Allow analytics). The choice applies to the browser you set it in.
Security questionnaires and certifications (SOC 2, ISO 27001)#
For a security questionnaire, questions about certifications such as SOC 2 or ISO 27001, or details about our security practices for your vendor review, ask for a person in the support chat or write to contact@alignifytech.com.
Reporting a security issue#
If you think you found a security problem, ask for a person in the support chat or write to contact@alignifytech.com. Please do not include passwords, API keys or tokens in the chat.