# Security

> The approval gate, tenant isolation, what Ray never does, and the memory controls.

Source: https://heyray.io/security

Ray does real work on its own and waits for a person on anything that reaches
outside chat. That line is architecture, not a preference, and this page is the
evidence for it.

## Approval is structural

Every action that changes something outside chat stops and shows you an approval
card before it runs: the email recipient, subject and verbatim body, the issue
title and description, the exact fields of an update. You click Approve or
Decline.

The gate is code wrapping every write tool, not a setting on a page. No admin,
no plan, and no prompt can remove it. Asking Ray to skip it changes nothing.
Declining leaves nothing behind, and Ray says plainly that nothing was created.

Reads are free and do not stop. Writes always do.

## The receipts

- **Your workspace is sealed off from every other.** Every table holding your
  data runs Postgres row level security in its strictest mode, and the database
  role Ray runs as physically cannot bypass it. We prove it by having one
  workspace try to read another's, eight different ways across eleven tables.
  All eight are blocked, and the build fails if a new table ever ships without
  the lock.
- **Failed work never costs you.** If Ray loops, stalls, or errors, that work is
  never counted and never billed.
- **Your messages never hit a log.** Ray reads a channel to do the job, then
  lets it go. Raw messages are never written to any log, and our analytics
  carry counts and costs, never content.
- **It works only where you invite it.** Ray acts in the channels you add it to
  and nowhere else. It never carries a secret into view.

## What Ray never does

- **We never train AI on your data.** Not us, and not the providers we send
  prompts to. Their API terms keep your data out of training.
- **We never hand your data to ad platforms.** No marketing identifiers handed
  to ad networks, ever. Ray is a subscription, not an ad business.
- **We never log your raw messages.** Ray reads what it needs in the moment and
  writes none of it to a log.
- **We never touch a channel you did not invite.** Add Ray where you want it. It
  stays there.

## Memory you control

Ray remembers what your team tells it, and you can see all of it from chat.
There is no dashboard, because the controls live where the work does. Ask what
Ray remembers and it lists the facts with their sources. Say forget that and the
fact is retired. An admin can switch durable memory off entirely or purge
everything, and purge is permanent and confirms in the channel first.

Memory is scoped by where it was said. A fact stated in a public channel is kept
for the workspace. A fact stated in a DM or a private channel is kept only
there.

## Common questions

**Do you train AI on our data?** No. We never train on your data, and the AI
providers we send prompts to do not train on API traffic either.

**Can we turn approvals off?** No, and that is deliberate. Approval on sensitive
actions is built into the code around each tool, not a setting you toggle.

**Who on your team can read our messages?** Nobody browses your content. Ray
keeps only the turns it is engaged in, there is no archive of your messages, and
our analytics carry metadata only.

**Where is our data stored?** Durable memory lives in managed Postgres, isolated
per workspace. Short lived state lives in Redis. The full subprocessor list is
in the privacy policy at https://heyray.io/privacy.

**What happens when we uninstall?** Ray revokes every integration token and
deletes your stored data. Short lived logs age out within 30 days at most. There
is a brief grace window in case it was a mistake, and then it is gone.

**Do you have SOC 2?** Not yet, and we will not imply otherwise. We are a small
team building the controls a SOC 2 audit checks for, and we will say so plainly
the day that changes.

The full security policy is at https://heyray.io/security-policy.