When you use an AI feature, only the information needed for that request is sent to an external AI service. We never send your organization's data in bulk.

Is my data used for AI training?

No. We only use AI services whose contract terms exclude API inputs from model training.

How much of Google or Slack can Addness see?

Only what you authorize. Google Calendar is read-only, Google Drive is limited to files you pick, and Slack is post-only: we do not read messages.

Can Addness employees see my data?

Not as a rule. Only when support or incident response requires it, only by authorized staff, and every session is recorded.

What happens to my data when I leave?

When you cancel and your subscription ends, the organization can no longer be used, but its data is not deleted. Subscribe again to pick up where you left off. When an organization or account is deleted, no one can open it and it cannot be restored. The data is retained rather than erased immediately, and we do not view its contents except where necessary, such as in response to a request based on laws and regulations. If you wish the data to be completely deleted, contact us individually and we will respond.

Where is my data stored?

Primary data (databases, files, and backups) is stored in Japan, in the AWS Tokyo region. AI processing, sign-in, error monitoring, analytics, delivery, payments, and part of meeting transcription are handled by external services in the United States or the EU. We have personal data processing agreements with our subprocessors outside Japan. The list of subprocessors is in section 4 of the Privacy Policy.

Can we run it on our own servers (on-premises) or a closed network?

No. Addness is provided as a cloud service.

Can we control who in the company can and cannot see what?

Yes. For each goal, you choose an owner, editors, and members (who can view and comment), and permissions on a goal carry over to the goals below it. A goal that is not assigned to anyone is not visible even to members of the same company. People invited as guests can only view, comment, and chat. Company administrators can see almost everything regardless of assignments, so we recommend keeping the number of administrators to a minimum.

Can we cut off access for people who leave or for contractors?

Yes. When an administrator removes the person from the organization, they can no longer access that organization, either in Addness or through their AI. Goals they were responsible for move to the owner of the goal above. To restore their access, invite them again.

Addness Security

This English translation is provided for reference only. If any discrepancy arises, the Japanese version shall prevail.

Last updated: October 2026

Addness stores your organization's goals, tasks, conversations, and meeting content. This page summarizes what we do to protect that data, to the extent we can publish. Details needed for a security review, such as architecture diagrams and answers to security questionnaires, are shared individually under a non-disclosure agreement.

Nine quick answers

What is sent to AI?	When you use an AI feature, only the information needed for that request is sent to an external AI service. We never send your organization's data in bulk.
Is my data used for AI training?	No. We only use AI services whose contract terms exclude API inputs from model training.
How much of Google or Slack can Addness see?	Only what you authorize. Google Calendar is read-only, Google Drive is limited to files you pick, and Slack is post-only: we do not read messages.
Can Addness employees see my data?	Not as a rule. Only when support or incident response requires it, only by authorized staff, and every session is recorded.
What happens to my data when I leave?	When you cancel and your subscription ends, the organization can no longer be used, but its data is not deleted. Subscribe again to pick up where you left off. When an organization or account is deleted, no one can open it and it cannot be restored. The data is retained rather than erased immediately, and we do not view its contents except where necessary, such as in response to a request based on laws and regulations. If you wish the data to be completely deleted, contact us individually and we will respond.
Where is my data stored?	Primary data (databases, files, and backups) is stored in Japan, in the AWS Tokyo region. AI processing, sign-in, error monitoring, analytics, delivery, payments, and part of meeting transcription are handled by external services in the United States or the EU. We have personal data processing agreements with our subprocessors outside Japan. The list of subprocessors is in section 4 of the Privacy Policy.
Can we run it on our own servers (on-premises) or a closed network?	No. Addness is provided as a cloud service.
Can we control who in the company can and cannot see what?	Yes. For each goal, you choose an owner, editors, and members (who can view and comment), and permissions on a goal carry over to the goals below it. A goal that is not assigned to anyone is not visible even to members of the same company. People invited as guests can only view, comment, and chat. Company administrators can see almost everything regardless of assignments, so we recommend keeping the number of administrators to a minimum.
Can we cut off access for people who leave or for contractors?	Yes. When an administrator removes the person from the organization, they can no longer access that organization, either in Addness or through their AI. Goals they were responsible for move to the owner of the goal above. To restore their access, invite them again.

At a glance

In transit	Encrypted with TLS 1.2 or later (TLS 1.3 supported)
At rest	Databases, files, and backups encrypted at rest (AWS KMS)
Authentication	One-time email code / Google / Apple, two-factor authentication (authenticator app)
Infrastructure	AWS Tokyo region, Multi-AZ
AI training	None
Data location	Primary data in Japan (AWS Tokyo). AI processing, authentication, error monitoring, hosting, payments, and other processing are handled by external services in the United States or the EU
Deletion	Organization and account deletion (deleted items cannot be restored; data is retained rather than erased immediately; complete deletion is available on individual request)
Monitoring	24/7 monitoring, operation logs, activity logs
Certifications	Not yet certified (we answer security questionnaires individually)

1. Security overview

Infrastructure

We run on Amazon Web Services (AWS) in the Tokyo region, and customers' primary data (databases, files, and backups) is stored in Japan. Some external services, such as AI processing, process data outside Japan (see the Privacy Policy for details)
The application runs on containers (Amazon ECS) and the database on Amazon RDS for PostgreSQL, replicated across multiple availability zones (Multi-AZ)
Databases and application servers sit inside a private network and are not directly reachable from the internet
Production and staging environments are separated
Infrastructure is managed as code, and changes are applied after review
Secrets (API keys, connection strings) are kept in AWS Secrets Manager, never in code or configuration files

Encryption

In transit: all traffic is encrypted with TLS 1.2 or later (TLS 1.3 supported)
At rest: databases, files, and backups are encrypted. Keys are managed in AWS KMS and rotated automatically
Integration credentials: access tokens for connected services are stored encrypted with AES-256-GCM

Backups and retention

Automated daily backups, retained for 7 days
Deletion protection is enabled on the database to prevent accidental loss
Retention: data is retained continuously during the service contract and is not deleted when your subscription ends after cancellation (the organization can no longer be used, but you can subscribe again to pick up where you left off). When an organization or account is deleted, its data is also retained rather than erased immediately (records that must be retained by law are kept for the required period)
Deletion: organizations and accounts can be deleted. A deleted organization or account cannot be opened by anyone and cannot be restored (as a rule, we do not restore from backups either). The data is retained rather than erased immediately, and we do not view its contents except where necessary, such as in response to a request based on laws and regulations. The retained data may be used to improve the quality of the Service in a form that does not use information specific to the customer (it is not used to train AI models). If you wish the data to be completely deleted, contact us individually and we will respond (applies to items deleted on or after October 17, 2026)
Goals and other items you delete individually are permanently erased after 30 days

Tenant isolation

An organization's data cannot be accessed from another organization
Files are stored in private storage and delivered only through time-limited signed URLs
Screen recordings are viewable only through time-limited signed URLs, and viewing rights follow the permissions of the linked goal

Employee access

As a rule, Addness employees do not view customer data
Access happens only when support or incident response requires it, and only by authorized staff
Production data access is split by role (read-only, read-write, administrator), and every session is encrypted and recorded
Cloud administration accounts are managed centrally through single sign-on

2. AI and your data

AI features (summaries, suggestions, meeting notes, chat) use the APIs of external AI services under contract with us
We send only the information needed for the feature. Your organization's data is never sent in bulk
Your data is never used to train AI models. We only use AI services whose contract terms exclude API inputs from model training
AI providers retain data for at most 30 days, solely for abuse monitoring
Actions taken by AI (creating or updating goals, for example) are limited to the permissions of the user who triggered them. AI never sees data the user cannot see
The Addness desktop app runs on your own computer. The app itself does not connect to AI models. When AI works with Addness data, your own AI client (such as Claude Code or Codex) reaches it through the Addness MCP server, within the scope you authorize. Addness never sends data to AI models on your behalf

3. Integrations

Integrations only run when you enable them yourself.

Addness never collects or stores passwords for external services. Integrations use OAuth, and access is limited to the scopes you grant
You can disconnect at any time. Disconnecting deletes the credentials stored in Addness

Google Calendar	Does: read events (read-only scope) / Does not: create, edit, or delete events
Google Drive / Sheets	Does: read and update files you pick / Does not: access files you did not pick
Slack	Does: post notifications from Addness / Does not: read messages
LINE	Does: notify and chat with accounts you linked / Does not: read chats you did not link
Meetings (Google Meet, Zoom)	Does: join invited meetings, record, and transcribe / Does not: join meetings it was not invited to
MCP servers	Does: use external MCP servers you connected / Does not: access services you did not connect

4. Access control

Available

One-time email code sign-in (no passwords stored) / Google and Apple sign-in / Two-factor authentication (authenticator app) / Account lockout after repeated failures and bot protection at sign-up / Organization- and goal-level permissions / Goal-scoped access for members of other organizations / Invitation link issuance and revocation by administrators / Activity log (goal changes, comments, member actions)

Not available

SAML SSO / SCIM provisioning / IP address restrictions / Audit log export

If you need one of the features not yet available, please contact us.

5. Operations and security practices

Monitoring and threat detection

Key metrics are monitored around the clock, and anomalies page an on-call engineer immediately
Amazon GuardDuty, AWS Security Hub, AWS Config, and IAM Access Analyzer are enabled
Operation logs (AWS CloudTrail) and network logs are stored in a separate audit account
We operate toward an availability target of 99.9% over 28 days. This is a target, not an SLA

Vulnerability management

Dependencies are updated automatically and scanned for vulnerabilities, and all code changes are reviewed
An external vulnerability assessment by a third-party company is currently being applied for. In the meantime, we run automated vulnerability checks every day using the latest local LLM
Vulnerability reports are accepted through the contact below. Reports are reviewed by our staff and fixed according to impact

Incident response

We maintain procedures for detection, containment, investigation, recovery, and reporting
If an incident affects customer data, we notify affected customers within 24 hours of discovery, as a rule
After each incident we record the root cause and preventive measures

6. Compliance and certifications

We have not yet obtained ISMS (ISO/IEC 27001), SOC 2, or PrivacyMark certification. We respond to customer security questionnaires individually.

Current practices

Encryption in transit and at rest
Organization- and goal-level access control with two-factor authentication
Daily backups with deletion protection
24/7 monitoring and threat detection
Dependency vulnerability scanning and code review
A privacy policy that complies with Japan's Act on the Protection of Personal Information and Telecommunications Business Act

7. Documents

Terms of Service
Privacy Policy (the list of subprocessors and external services is in section 3-1)
Available under NDA: system architecture diagram, answers to security questionnaires, data processing addendum

Contact

For security questions, detailed documentation, or vulnerability reports, use the support form or email privacy@team.addness.co.jp.