Security at Pyng

Pyng holds the most sensitive thing a professional owns: private context about the people they work with. This page describes, plainly, how that data is protected today. We describe only what is actually in place — no certifications we do not hold.

What Pyng stores, and what it never touches

Where your data travels

Data isolation

Every table that holds your data enforces row-level security at the database, not just in the application. Each row carries the owner's account ID, and the database itself rejects any read or write that does not match the signed-in account. A bug in the app cannot hand one customer another customer's contacts, notes, or memos, because the isolation is enforced one layer below the app.

Encryption

• All traffic to and from Pyng is encrypted in transit over TLS.
• The database and file storage that hold your notes, transcripts, and voice memo audio are encrypted at rest by our infrastructure provider, including backups.
• Access tokens for Live Context accounts (Google Calendar, Gmail) are additionally encrypted with AES-256-GCM using a key held outside the database, so the stored value is unreadable even to someone browsing the database directly.
• Voice memo audio lives in a private storage bucket that is never publicly readable and is only served through short-lived, per-request signed URLs.

To be precise about a term people use loosely: Pyng is encrypted in transit and at rest, not end-to-end encrypted. Our servers can process your content in order to run the Signal Engine and write drafts. We say so plainly rather than imply a guarantee we do not provide.

Who can see your data

• The people you watch, your notes, memos, and drafts are visible only to your own signed-in account. No other subscriber can see who is on your list, and there is no shared or public directory of people being followed.
• Cross-account reads are blocked at the database layer, not just in the app.
• A small founding team can reach production infrastructure to keep the service running and to investigate incidents. That access is logged, used only when needed, and never used to browse customer content casually.
• Your content is never sold, never shared with other subscribers, and never used to train third-party AI models.

Legal process

We would only disclose customer data where we are legally compelled to do so. If we receive a subpoena, court order, or regulatory demand relating to an account, we will tell the affected subscriber unless we are legally prohibited from doing so, we will narrow or challenge requests that are overbroad, and we will disclose no more than the request actually requires.

Connected accounts (Live Context)

Google Calendar and Gmail are connected per person, through Google's own consent screen, with the narrowest scopes each feature requires. Pyng never asks for your Google password. You can revoke a connection from Settings at any time, which deletes the stored credential on our side as well.

Gmail is read as metadata only — sender, recipient, subject and timestamp, limited to the people already in your orbit. Message bodies are never fetched, stored, or sent to a model. It powers one thing: an accurate last touch, and knowing when someone replied to you.

Access control

• Two-factor authentication is available on every account from Settings.
• You can sign out of every device from Settings.
• Security-relevant events on your account — sign-ins, exports, deletions, connector changes — are recorded to an activity log you can read, and that the app cannot edit or erase.
• Administrative access to production is limited to the founding team and is not used to read customer content except when you ask us to investigate something.

How AI is used

When Pyng drafts a message, summarizes a relationship, or extracts facts from a voice note, it sends the minimum content required for that one request to our AI provider. Those requests are covered by commercial terms that prohibit using submitted content to train the provider's models. Your notes, memories, and transcripts are never used to train models — ours or anyone else's. Public web pages we read on your behalf are fetched only for contacts you added yourself.

Your data, your call

• Export everything you have stored, at any time, in one click.
• Delete a memory, a contact, or your entire account. Deleting the account removes your rows and your stored files, including voice memo audio.
• Set voice memos and transcripts to auto-delete after 30, 90, or 365 days.

Retention and deletion

Vendors

We keep the list of subprocessors that can touch customer data short and public. See our subprocessor list. Related reading: Privacy and Terms.

Compliance posture

Corporate reviewers usually ask one question: what do you hold, and what can you show me today? Here is the honest three-part answer.

Certifications held today: none. Pyng does not hold SOC 2, ISO 27001, or any other third-party attestation, and we will not imply otherwise. SOC 2 is an auditor's opinion on operating controls over a monitored window, not an encryption standard — so the useful question in the meantime is which of those controls already run in production.

Controls already in place — the things an audit would test:

• Tenant isolation enforced at the database layer, below the application.
• TLS in transit; AES-256 at rest for the database, backups, and stored files.
• Connected-account tokens encrypted with a key held outside the database.
• Two-factor authentication and full device sign-out available to every account.
• An append-only account activity log covering sign-ins, exports, deletions, and connector changes.
• Least-privilege production access limited to the founding team, used for operations and incidents.
• Data minimization by design: email metadata only, calendar read-only, no message bodies, no model training.
• A published subprocessor list and a monitored vulnerability contact.

Roadmap, in the order it will happen: formalize written policies and access reviews, commission a third-party penetration test, complete a SOC 2 Type I readiness assessment, then run the Type II observation window. We are not publishing target dates we cannot guarantee — if you need a timeline for a specific procurement review, ask and you will get our current honest estimate.

Reporting a vulnerability

If you believe you have found a security issue, email security@pyng.co with enough detail to reproduce it. We will acknowledge within two business days. Please do not publicly disclose before we have had a chance to fix it, and please do not access, modify, or retain data that is not yours while testing.