How HomieDesk protects your data.
HomieDesk protects your account with two-factor sign-in, roles and a CAPTCHA at sign-in, and protects your contacts with approval before sending and unsubscribes that stick. Here's what we do today and what we're still closing.
Two-factor sign-in
Turn it on in My account: on top of your password or Google, sign-in asks for the code from your authenticator app. Changing your password ends your other open sessions and your MCP connections.
Roles and permissions
There are two roles: Admin and Sales. Sales works with the whole CRM; managing the organization, the team and billing is Admin only, and the database rejects that change even if someone gets there another way. Taking someone off the do-not-contact list is also Admin only.
CAPTCHA at sign-in
Sign-in and sign-up have a Cloudflare CAPTCHA (Turnstile) that stops automated programs trying to guess passwords or open accounts.
Each organization sees only its own data
Each account can only read its own organization's data, and that rule is enforced in the database, not just on screen. Communication with the application is always encrypted in transit (HTTPS).
Your mailbox is yours
A connected mailbox is private by default: only you read your email, and the rest of the team sees that there was a conversation with the client, without the subject or the content. Opening it to the team is your call.
Private notes
A private note is visible only to whoever wrote it, not even to admins. For everyone else it doesn't exist: it doesn't show up in lists, in the chat, in the AI or in reports.
Encrypted Google keys
The keys Google issues to connect your account are stored encrypted at rest (AES-256-GCM). If you disconnect Google from the CRM, they're deleted and syncing stops.
Nothing with an outside effect without your click
Anything you ask Homie that has an outside effect, like sending an email or scheduling a meeting, is shown first on a card with Apply and Cancel. Nothing happens until you approve it.
Prospecting emails wait for your approval
As long as an outbound agent isn't in Automatic mode, every email waits in your queue, where you see it exactly as it will arrive. Moving it to Automatic is always a person's decision, and if bounces or unsubscribes get worse, the agent goes back to asking for approval on its own.
Unsubscribes stick
Every prospecting email carries a one-click unsubscribe link, and a reply asking not to be contacted counts too. Those addresses go on a suppression list that is checked before every send; if a failure means it can't be read, no email goes out.
A cap per mailbox
Each mailbox sends at most 60 emails a day, adding up all its campaigns and the agents' emails, counted from midnight in your time zone. Protecting your email reputation is worth more than volume.
Where your data lives
The database and files are on Supabase (Postgres) and the application runs on Vercel. OpenAI and Anthropic, the AI models we use, receive only the text each task needs, through their APIs.
What we're still closing
- ×Google's CASA verification, which Google requires for Gmail permissions. We're preparing it and the deadline is January 2, 2027. Until then, our Google app is still in testing mode, so connecting Gmail on new accounts is limited.
- ×We don't have SOC 2 or ISO 27001 certification today.
- ×Each person turns on two-factor sign-in themselves: it can't yet be required for the whole team from the organization.
Frequently asked questions
Where is my data stored?
On Supabase, which is our database (Postgres) and where we store files. The application runs on Vercel. For AI work, OpenAI and Anthropic receive only the text needed for each task, through their APIs.
Who can see my email?
You. Your mailbox is private by default: the rest of your team sees that there was a conversation with the client, but not the subject or the content, unless you choose to open it. No other organization sees your data, and nobody reads your Google data unless you authorize it for support, for security or where the law requires it.
Can I delete my data?
Yes. From Settings, Email, Disconnect Google, the keys are deleted and syncing stops; you can also remove access from your Google account. To delete what's already stored (email, transcripts, summaries), write to hello@homiedesk.com and we'll do it within 30 days.
Do you use my data to train AI models?
We don't use your Google data to train artificial intelligence models, or for advertising, and we don't sell it. OpenAI and Anthropic, which do the AI work, don't use that data to train their models either.
Do you have SOC 2 or ISO 27001?
Not today. We're preparing Google's CASA verification, the one Google requires for Gmail permissions, with a deadline of January 2, 2027.