Security & data privacy

Your work stays yours

Verkion is built so AI helps without taking over and your data stays isolated. Here is exactly how.

Your data does not train AI models

Your notes, tasks, and documents are processed only to generate suggestions for you. They are not used to train any AI model. Verkion uses the OpenAI API, which does not train on data sent through it.

Workspace isolation at the database level

Every row of your data is protected by Postgres row-level security, scoped to your workspace. The database — not just the app — enforces that one workspace can never read or write another’s data.

AI never acts without you

Verkion’s AI proposes; it never disposes. Every AI suggestion — a task, a decision, a link — is created only after a human approves it, and each is cited back to its source so you can verify it.

Authentication & access control

Accounts are protected by Supabase Auth with secure password reset and optional Google sign-in. Roles (owner, admin, member) gate what each person can do inside a workspace.

Connected agents are scoped and audited

An AI agent you connect (for example Claude or ChatGPT over MCP) acts as you, with your permissions and nothing more. It can do what you can do in the app, such as creating tasks, updating their status and commenting, and every change it makes is logged. Reassigning or deleting tasks, changing an initiative’s status, assigning roles and plans that hand work to people wait for a person to approve them, and you can switch an agent to read-only or disconnect it at any time.

Encrypted in transit

All traffic is served over HTTPS/TLS. Data is stored on managed, encrypted Postgres infrastructure (Supabase) hosted on enterprise-grade cloud providers.

Have a security or compliance question for an evaluation? Get in touch.

Frequently asked questions

Does Verkion use my data to train AI?

No. Your content is used only to generate suggestions for you and is never used to train any AI model. Verkion sends prompts to the OpenAI API, which does not train on API data.

Can other workspaces see my data?

No. Every workspace is isolated by Postgres row-level security at the database layer, so data from one workspace can never be read or written by another, even via the API.

Does the AI ever create or change things on its own?

Verkion’s built-in AI does not: its suggested tasks, decisions and links become real only after a person approves them. If you connect your own AI agent (for example Claude or ChatGPT over MCP), it acts as you, under your permissions. It can do what you can do in the app, such as creating tasks and notes, updating task status and commenting, and every change it makes is logged. Reassigning or deleting tasks, changing an initiative’s status, assigning roles and plans that hand work to people wait for a person to approve them.