Security

This page says how Utalis protects a workspace, in plain words. It describes what the product and our servers do today. Where something is not done yet, it says so.

Where your data lives

• Utalis runs on servers rented from Hetzner Online GmbH in Germany: the application, the database, stored files and meeting recordings.
• The AI models that employees think with are Google's Gemini on Vertex AI. For text, images and video, Google serves them from its global service, so we do not choose the country they run in. Live voice in calls runs in Google's US Central region. Google may not use your data to train its models.
• A cloud computer, when you give an employee one, runs on Google Cloud in Frankfurt, Germany, and exists for one job.
• Every service that processes customer data is on the Sub-processors page, with what each one receives.

Encryption

• In transit. Browsers, the phone apps and the desktop app reach Utalis over HTTPS and secure WebSockets (TLS 1.2 or newer).
• At rest, secrets. These are encrypted in the database with AES-256-GCM, a fresh random value for every entry, and the name of the field bound in so a value copied into another field cannot be read: the access tokens and API keys of connected services, saved logins, cards and other saved details, two-step sign-in secrets, password hashes, and the signing keys of employees. The encryption key is kept in the server's settings, outside the database. Keys can be rotated: older keys keep decrypting while new values use the new one.
• At rest, everything else. Messages, notes, files and records are protected by access rules and the hosting provider's physical security. The application does not encrypt them separately.

Signing in

• Passwords are stored only as salted scrypt hashes, and the hash is encrypted as well.
• Two-step sign-in with an authenticator app is available to everyone, with ten single-use backup codes. A new account must confirm its email address before it can open the app.
• The page of signed-in sessions in Profile lists every signed-in device. You can sign out one device or all of them, and resetting a password signs every device out. A session lasts at most 14 days. Only a hash of the session token is stored.
• Utalis does not offer single sign-on (SAML or OpenID Connect) yet.

Roles and departments

• A workspace has five roles: owner, admin, member, auditor and guest. The owner has everything including billing; admins everything except billing; members work with the employees of their departments; auditors read everything and change nothing; guests get only what a department gives them.
• Departments have their own roles (lead, member, observer), and an employee can be visible to the whole workspace or only to its department.
• Every request is checked against the workspace it belongs to, and by the role of the person asking.

What employees can and cannot do

• Employees never hold your passwords or tokens. A connected service's access is handed over for one action at the moment it runs, limited to that employee's permissions. Saved logins are filled in by Utalis, and only on the website or app they belong to; the employee names the field and never sees the value.
• Some actions always wait for a person, at every level of trust: email to people outside the company, invoices, payments, meetings with outside guests, sharing documents outside, and commands on a person's own computer. An approval covers one action with exactly the details shown. If those details change, the approval no longer fits and the action does not run.
• Your own rules. Owners and admins write approval rules: which actions are forbidden, and which need whose approval, by action, service, department and amount.
• New employees start on probation. On probation an employee only proposes what it would change, and nothing runs until a person graduates it. After that, independence is earned with a track record, and money is never approved by track record.
• An employee that keeps failing is stopped. Three failed runs in 24 hours suspend it for a day. An owner or admin can pause any employee at any time, and an emergency stop makes every change wait for a person.
• Incoming content is screened. Emails and messages that arrive from outside are checked by a model for instructions meant to hijack an employee before the employee acts on them. Anything blocked or unusual becomes a security incident that a person reviews.

Employees on computers

• The desktop app and its helper work only in the apps a person allowed on that computer, and refuse every other app, whatever the model asks. Pictures are of the allowed app's own windows, never the whole screen.
• Changes that commit something (pay, send, delete, change a setting) go through the approval rules. A commit made any other way is held by the helper's guard.
• Work pauses the moment a person touches the mouse or keyboard, and the person can pause it or take the computer back at any time.
• Secrets on the screen (passwords, card numbers, keys) are painted over before a picture leaves the computer.

The record

• Every action an employee takes, every approval and who decided it, and every change to a connection is recorded. Owners, admins and auditors read it in Activity, with filters, and export what they filtered as a file.
• Work on a computer can be replayed step by step.

How long we keep things

Deleting your data

• You can delete files, handbook pages, saved details, meetings and employees yourself, and disconnect any service.
• A workspace's owner can delete the whole workspace (Settings, People), and anyone can delete their account (Profile, Security). Both ask for your password and for the workspace's name or the word DELETE, and both take effect at once.
• Deleting a workspace deletes everything in it for good: jobs, messages, files, notes, saved logins, connections and records. Its employees are let go, its computers unpaired, the access it gave at connected services is ended where the service allows it, and its stored files and meeting recordings are deleted. Deleting an account also deletes the account, its sessions and its picture, and removes the person from other workspaces. What they wrote in someone else's workspace stays in that workspace's record, without their account.
• Only the records of money stay, for 10 years, because bookkeeping law requires it.
• A deletion cannot be undone from the app.

Suspending or letting go an employee, and removing a person

• Pause stops an employee starting work and can be undone. Let go is final: its open approvals are declined, its routines and triggers are switched off, the saved logins kept only for it and its browser profiles are deleted, and its email address is released. Its record stays and becomes read-only.
• Owners and admins can suspend a person's access, restore it, or remove them from the workspace.

What we do not have yet

• Utalis holds no security certification, such as SOC 2 or ISO 27001, and has not commissioned an independent audit or penetration test.
• No single sign-on.

Report a vulnerability

If you find a security problem in Utalis, write to security@utalis.com. Our contact details and policy are also in security.txt.

• Tell us what you found and how to reproduce it. Please do not publish it before we have fixed it.
• Test only against your own account and workspace. Do not read, change or delete other people's data, do not degrade the service, and do not phish or otherwise target our staff or customers.
• We read every report and reply by email. We do not run a bounty program.

More

Sub-processors, Data Processing Addendum, Privacy Policy, Terms, Status.