Trust & data
Your company information and customer conversations deserve careful decisions. Understand how a workflow operates, what it can access and where your review belongs.
Working with AI
Assistants work in Manual, Plan or Auto, and the web app starts in Manual. In Manual, sends, posts, CRM writes, MCP calls, calendar changes and new lead runs wait for your approval. Plan queues them and Auto runs them, except template sends and calendar deletions, which always ask first.
AI can make mistakes. Inspect research sources, review every message and check records before an output goes into a decision that matters. Research replies carry numbered citations and a source list, so checking the original is part of the work.
Adding Company Intel, including your brand voice, does not change the AI model itself. Agent memory can be switched off with "Remember my conversations" in Settings. Check the current policies for data processing, retention and other privacy terms.
Evaluating a tool
Ask any vendor which systems it connects to and what each connection can read. In Pebbles Ai, you choose the connections in Settings: email inboxes such as Gmail and Outlook, Google Calendar, workspace tools such as Notion and Slack, and servers from the MCP catalogue. The assistants work with the accounts you connect, and you can disconnect any of them.
Ask any vendor whether your data trains a model, theirs or anyone else's, and get the answer in writing. In Pebbles Ai, the answer is no. Under Tenant-Isolated AI, our own architecture for tenant isolation, every business works in its own secured tenant. No data crosses between tenants, and no customer's data trains a model. Adding Company Intel does not change the model itself.
Ask any vendor which actions run on their own and which wait for a person. In Pebbles Ai, the execution mode decides: Manual, Plan or Auto. The web app starts in Manual, where sends, posts, CRM writes, MCP calls, calendar changes and new lead runs wait for your approval. Plan queues them. Auto runs them, except template sends and calendar deletions, which always ask first.
Ask any vendor whether answers show their sources, so you can check them before you rely on them. In Pebbles Ai, research replies carry numbered citations and a source list. The researcher is instructed to back key claims with two independent sources where possible and to flag single-source claims. AI can still make mistakes, so review sources, messages and records before they feed a decision.
Ask any vendor what the tool remembers between conversations and how you stop it. In Pebbles Ai, Agent memory keeps short facts you state or confirm, not your documents, CRM records or drafts. Turn off "Remember my conversations" in Settings and the assistants neither read nor save memories. You can also ask an assistant to forget a fact in plain words.
Ask any vendor whether disconnecting also revokes access at the provider. In Pebbles Ai, Disconnect removes the stored credentials in Pebbles Ai. It does not revoke the grant at Google, Microsoft, Slack, Notion or the MCP server, so revoke access in that provider's own account settings as well. An expired connection can be reconnected in Settings.
Ask any vendor which assessments it holds today and which are only planned. Pebbles Ai holds CASA Tier II, the assessment Google requires for Gmail and Google Workspace access, and Microsoft 365 Certification, and is GDPR compliant. SOC 2 Type II and ISO 27001 are in progress, targeted for Q2 2027. Tenant-Isolated AI is our own architecture, not a certification.
Ask any vendor for its written policies on retention, processing and sub-processors, not a summary. For Pebbles Ai, check the current privacy policy for data processing, retention and other privacy terms. The trust centre holds the certification evidence. Both are linked under the policies on this page. For a procurement or security review, ask the team for evidence and contractual terms.
Each answer gives the question to put to any vendor, then what Pebbles Ai states. For the source documents, go to the policies.
In the product
Uploaded files are virus-scanned as they arrive. A file flagged as infected is blocked and does not enter your workspace.
Code runs in an isolated sandbox with no outbound network and a read-only file system. Each run writes an audit line and stops after 180 seconds.
Sign in with Google, Microsoft or a one-time code sent by email, with no password to store or lose. Session cookies are host-only.
Independent review
The security assessment Google requires of applications that connect to Gmail and Google Workspace data.
Microsoft's review of the security and data handling behind our Outlook and Microsoft 365 connections.
How we collect, process, store and delete personal data, as EU and UK data protection law requires.
An independent audit of how our security controls work over time, with the report targeted for Q2 2027.
Certification of our information security management system by an accredited body, targeted for Q2 2027.
Every business works in its own secured tenant, with its own data, memory and assistants. No data crosses between tenants, and no customer's data trains a model.
Certification documentation is available through the trust centre before you commit.
Source documents
Use the trust centre and published privacy policy for current documentation. For procurement or security review, ask the team for evidence relevant to your requirements.
Discuss connected providers, access controls, data requirements and the workflows you intend to run. The trust centre holds the certification evidence, and the team provides contractual terms.
Contact the team