How we protect your programme data.

Hosting

CommandCC stores data in Supabase, a managed Postgres platform that also provides authentication and file storage. The application and this website are served by Vercel.

Encryption

Data travels over HTTPS between your browser and our services. Supabase encrypts the database and stored files at rest.

Access control

Row-level security limits database records to members of the company that owns them.

On Enterprise, roles set what each person can edit. On every plan, stakeholders have a limited role: they can read, comment and raise risks, issues and actions. There are seven roles: administrator, programme manager, functional lead, technical lead, consultant, viewer and stakeholder.

Signing in

People sign in with an email address and password through Supabase Authentication, which stores passwords as hashes. Single sign-on is not available today. Tell us if your organisation requires it.

Audit log

Changes made through the app's record forms are written to an audit log that administrators can filter by user, action and record type.

Speech and AI

AI is optional, on Professional and Enterprise. Each person turns it on in their own settings and chooses whether to use it for agents and project updates, for speech to text, or both. A company admin can block AI for the company. Each person can use one of these providers: Anthropic, OpenAI, OVHcloud, Mistral or Groq. When the desktop app is released, it will also be able to use another OpenAI-compatible service.

Each person adds their own key for one of those providers. Requests from the assistant, the agents, the health assessment and voice go from that person's device directly to the provider they chose, under their own account and that provider's terms. CommandCC does not receive the key or the prompts, and has no AI sub-processor. Nothing is sent to another provider instead.

A request carries what it needs from that programme's records, which can include the names and roles of team members and the names of milestones. CommandCC does not store recordings. A proposed change is saved only when a person accepts it.

CommandCC stores what is kept from AI: each accepted change, with the passage of the meeting or request it was based on and, for a typed request, its first 500 characters. A health assessment is saved to the project when it runs.

On the web, the key stays in that browser, encrypted with a key the browser cannot export. When the desktop and mobile apps are released, they will keep keys in the device's secure store. A key belongs to one person and is forgotten on that device when they sign out.

Speech, including dictation into a record's text fields, is turned into text by your provider's speech service or on your device, as you choose (always on your device if your provider is Anthropic, which has no speech service). In the browser, a person can choose on-device speech in Settings. The speech model is downloaded once from Hugging Face, and no audio or programme data is sent with that download. The desktop app, coming soon, will also be able to turn speech into text on the computer itself.

Your data

Your data belongs to you. We do not sell it and we do not use it to train AI models. Plans export to Excel from the app. If you need a full export of your programme data, ask us and we will provide it.

Sub-processors

We use a small number of sub-processors to run the service. CommandCC has no AI sub-processor: AI requests go from your device to the provider you choose, with your own key.

• Supabase: database, authentication and file storage
• Vercel: application and website hosting
• Resend: transactional email

Reporting a vulnerability

If you find a security issue, please email us with the details. We will acknowledge your report and keep you informed while we fix it.

Security reports: support@noeldcosta.com

Security reviews

We complete security questionnaires and walk your security team through our practices on request.

Security questions: support@noeldcosta.com