What we built, not what we claim.

Every record carries your company's identifier and Postgres row-level security decides, on every query, whether the person asking may see it. The rule is enforced in the database and in our server code, never only in a screen. We test that one company can't see another's data as part of every release.

Company admins, security approvers, billing contacts and every Cowkeeper staff member sign in with MFA. Approving a sensitive change requires a fresh MFA level at the moment of the decision, and the approver can never be the person who asked.

Cowkeeper connects to Google Workspace or Microsoft 365 through authorized, least-privilege access that you grant and can revoke from your settings. Tokens are encrypted at rest and only ever used inside our servers. Read access comes first; any change-making permission is a separate, documented consent.

There is no all-powerful role. Staff reach a company's data through an assignment, or a short, reasoned, time-limited access grant. Both appear in your account's access log, where your admins can see who looked and when.

"Verified" means a connected system or a named Cowkeeper confirmed it, with a timestamp and a reference you can read. Checkboxes and tutorials cannot produce it. When evidence goes stale, the status returns to Unknown. We show Unknown on purpose.

The assistant answers from your approved knowledge and prepares requests. It cannot approve, grant, reset, suspend or wipe anything, and the content it reads (documents, emails) is treated as data, never as instructions. Destructive actions need two different humans and a cooling-off period.

Scenarios are written by Cowkeepers, reviewed by a second Cowkeeper, and validated so they contain no password, code or payment fields, no real brands and no external links. Drills go only to domains you've verified, only after your security approver signs off, and land on a teaching page with no inputs.

We keep the minimum: work identity fields, device identifiers, security signals and the records you'd need for an audit. Chat history and phishing-report uploads expire on a schedule you can tighten. When a contract ends you get your data back and we delete ours.

Cowkeeper is not a certification body, does not operate a 24/7 security operations centre, and does not provide forensic incident response or penetration testing within the monthly fee. Independent security review is part of our launch process, and we will publish a summary of what it finds.