Security at Espresso

What we do to protect your data, what we log, who helps us run Espresso, and where to report a problem.

How it is built

The web app is a static website. Your data sits in a database where rules on every table decide who can read or change each row. Some work (AI features, email, sign-in codes, scheduled jobs) runs in server functions that can reach data the table rules would hide, so each has its own checks and they are reviewed separately.

Hosting

Cloudflare Pages (the website). Supabase (database, sign-in, files and server functions), with the database in London

Database requests

Through Supabase’s PostgREST layer, which uses parameterised queries

Client key

Only the public (publishable) key is in the web app

Stored content

Rich text is cleaned before it is shown, stored links and images are limited to safe addresses, and spreadsheet downloads neutralise formula cells

Signing in

People sign in with a code sent to their email address. Access is by invitation; there is no self-registration.

Who can get an account

Invitation only. Sign-up is switched off at our login service; an organisation administrator or MGH invites each person

Sign-in code

An 8-digit code emailed to the person. It works once, expires after an hour, and wrong guesses are counted and capped

Passwords

Optional. At least 12 characters, checked against known leaked passwords. Changing one from an older sign-in needs a code emailed to the person

Sessions

A sign-in lasts one hour at a time and is renewed in the background; renewal tokens are replaced each time they are used

Second factor

None beyond the emailed code. There is no authenticator app or security key yet

Watching for abuse

Wrong and refused attempts are recorded with the network address, and repeated ones alert us (see what we record)

Multi-Tenant Data Isolation

Your organisation's data is kept apart by Row Level Security in the database, not only by the app. We test this by trying forbidden actions as each role, and we fix gaps when we find them. We do not claim it can never fail.

Isolation Model

PostgreSQL Row Level Security, switched on for every table in the app’s database

Between organisations

Blocked by database rules, tested role by role

Our access

MGH staff can see all organisations when supporting them, including by opening a read-only view as a named person (see what we record). Automated tools that work for us can also reach more than one organisation’s data

Who can see what

Set by your role (below) and, for modules such as Lead Gen, RevOps and Reports, by a switch an administrator sets for each person

Encryption

Data is encrypted in transit and at rest by our hosting providers. We do not add our own encryption on top.

In Transit

  • HTTPS for the website, and for everything the web app sends to Supabase
  • Plain http requests are redirected to https

At Rest

  • Database encrypted at rest (AES-256, as stated by Supabase)
  • Files encrypted at rest (AES-256, as stated by Supabase)
  • Offline mode is off unless a person turns it on. When on, saved answers sit in the browser’s storage on that device, are removed at sign-out and are treated as expired after 14 days. Changes made offline that have not been sent yet stay on the device until they are

Role-Based Access Control

Three roles limit what each person can see and change. Access to individual modules is also switched on person by person by an administrator.

Super AdminPlatform-wide

Access to all organisations, projects and users. Held by MGH staff for support and operation.

Org AdminOrganisation

Manages projects, tasks and members in their organisation. Can see all of its projects.

MemberProject

Sees and edits the projects they are added to, and can read projects their organisation has shared. Can create private projects of their own.

Data protection and providers

For personal data your organisation puts into Espresso, your organisation decides what goes in and we handle it to provide the service. We list below who helps us do that. Certificates mentioned belong to our providers, not to MGH.

Roles

Your organisation decides what data it puts in and is responsible for it. We handle it to provide the service.

Where data is held

Database and files in London (Supabase, on AWS). Some providers below are based in the United States.

Provider reports

Supabase and Cloudflare state that they hold SOC 2 Type II reports. MGH holds no SOC 2 or ISO certificate of its own, and we do not claim compliance with any scheme.

Who helps us run Espresso

Supabase (database, sign-in, files), Cloudflare (hosting), Resend (email), Anthropic (AI features), GitHub (a nightly record for our own agents). Full list below.

Infrastructure Security

Built on cloud providers that publish their own security information. Any certification belongs to the provider, not to MGH.

Database

Supabase Postgres on AWS, London

Website delivery

Cloudflare Pages and CDN. HSTS asks browsers to use https for 30 days after a visit

File Storage

Supabase Storage, encrypted at rest by the provider

Browser protections

Other sites cannot frame Espresso; browsers are told not to guess content types; the referrer is limited; device permissions are restricted (the microphone is for voice notes only). A Content-Security-Policy is running in report-only mode: it records what it would block but blocks nothing yet, apart from framing

Releases

The website is released twice a day, around 07:00 and 19:00 UK time, when there is something new and every check passes. Database changes and server functions are applied by us by hand

AI features

Some features use AI. What you submit to them is sent to Anthropic, a provider based in the United States, to produce the answer.

  • Who can use it: every AI feature that a person starts needs a signed-in, active account and the right to use that feature. Scheduled AI work, such as the RevOps analyst’s notes, is started by our own schedule, not by a person.
  • Limits: each feature has a daily limit for each person, and there are daily spending limits for each person and for each organisation.
  • Logging: every AI call is logged with the feature, size and outcome, not the text. Questions to Ask AI are kept with their answers (see what we record).
  • Voice notes: Espresso uses the speech recognition built into the browser, which is provided by the browser maker (in Chrome, Google). The resulting text is saved in Espresso and, when you ask for it to be filed, sent to Anthropic like any other AI request.

What we record

We keep a few records so we can run and protect the service. We do not record the content you type in the usage logs.

  • Comments and status changes on tasks: who, what, when. Kept with the task.
  • Use of each area: which area was open and for how many minutes, per person. No page content. MGH can read the record; your organisation’s admins see weekly totals.
  • Lead Gen: which tender a person opened, and when. MGH can read the record; your organisation’s admins see weekly totals of use.
  • Sign-in sessions: when a person signed in and for how long.
  • Sign-in record: each request for a code and each attempt to use one: the email address entered (including addresses with no account), the time, what happened (sent, accepted, wrong or refused) and the network address it came from. Only MGH can read it.
  • Security record: changes to who can do what: role changes, switching a person on or off, module access and project seats, organisation changes, invitations and bulk deletes of tasks. The database writes it itself, and it cannot be edited or deleted through Espresso, including by our own server functions, apart from the scheduled clean-up after 12 months. Only MGH platform administrators can read it. MGH is emailed at once about the most sensitive changes and receives a summary each morning.
  • View as: MGH staff can open a read-only view of Espresso as a named person in an organisation, to see what that person sees when they report a problem. Only the platform administrator, or an MGH operator login in that same organisation, can do this, and nobody can view as a platform administrator. A view lasts 30 minutes, cannot change anything or touch the person’s account, and is recorded: who looked, as whom, when, and how it ended. Only MGH platform administrators and the person who looked can read the record. Deleted after 12 months.
  • Questions to Ask AI: the question, the answer and who asked. The person who asked and MGH can read them; colleagues and administrators cannot. Deleted after 12 months.
  • AI calls: which feature ran, which model, the size, the outcome, and for which person and organisation. Not the text.
  • Access requests: name, work email and organisation typed into the request form, plus a one-way fingerprint of the sender’s network address that changes every day and is used only to limit repeats. Deleted after 12 months.
  • Page-load problems: when a page fails to load or a new version swaps in: the page address (with long secrets blanked out), the version, the browser identifier and, if signed in, the person.
  • Provider logs: Cloudflare and Supabase keep their own technical logs (such as IP addresses) under their own retention.
  • How long: every record above is deleted automatically 12 months after it was made, except comments and status changes on tasks, which stay with the task. The work your organisation puts into Espresso (tasks, notes, grades and similar) stays while its account is active, as our Terms say in section 6. Providers’ own logs follow their own retention.
  • Not recorded: reads of your data are not logged (including what a person at MGH reads inside a View as session, which logs only that the view happened), and some bulk changes and moves are not logged on the task. Do not rely on these records as a complete audit trail.

Who helps us run Espresso

These companies may handle information your organisation puts into Espresso, or information about the people who use it. We will update this list when it changes.

  • Supabase (on Amazon Web Services), London: database, sign-in, file storage and server functions.
  • Cloudflare: hosting, delivery and DNS for the website, and technical logs. Cloudflare Web Analytics is switched on for this website to count page views and measure loading speed; Cloudflare states that it uses no cookies or local storage and does not fingerprint visitors for this.
  • Resend, based in the United States: sign-in codes, invitations, reminders and notices by email. It sees the recipient’s address and the message text.
  • Anthropic, based in the United States: the AI features. What you submit to an AI feature, which can include notes, documents, transcripts and tender text, is sent to Anthropic to produce the answer.
  • GitHub, based in the United States: MGH keeps the instructions for its own agents in a private GitHub repository. Each night Espresso writes one file there recording how those agents’ suggestions and findings were decided: counts and dates, the most recent reasons typed when one was turned down (up to 200 characters each), and the names of boards that still have details missing. The repository is private to MGH, and our agents, which run on Anthropic, read the file to prepare their check-ins.
  • Your browser’s voice dictation (where you use it) is provided by the browser maker, for example Google in Chrome.
  • Your own PostHog and Stripe accounts, only where your organisation connects them to the RevOps module: Espresso reads totals and counts from them with a key your organisation provides, and keeps only the totals. Nothing from Espresso is sent to them.

Please note: This page describes our controls as of the date below. Certifications such as SOC 2 Type II are held by our providers (Supabase, AWS, Cloudflare), not by MGH Ltd. Your organisation is responsible for its own policies and for deciding what personal data it puts into Espresso. This page is not legal advice and is not a promise of a result.

Found a problem?

Email us with what you saw and how to repeat it. We will reply within three working days. If you think personal data has been exposed, say so in the subject line.

Please tell us before you share it anywhere else, and while you check, please do not look at, change or copy other people’s data or disrupt the service. We do not have a security team; reports go to the people who run Espresso.

Email: [email protected]

Describes our controls as of 8 November 2026 · Powered by MGH Ltd