Per-client isolation
Each client runs in its own isolated deployment with dedicated datastore credentials and a dedicated Notion workspace. One client cannot access another's data.
Trust Center
Your organization's memory,
held with care.
Saberra captures what your team decides and commits to, and organizes it into your own Notion workspace for human review. Here is exactly how we protect it.
All systems operational.Every service exposes a monitored health endpoint. Deploys are health-gated.
01: Data handling
Six principles behind how we hold your data.
Every architectural decision about your data comes back to one rule: your memory belongs to your organization, not to us.
Human review, always
Saberra never publishes or approves changes to your canonical records. It proposes drafts. Your people decide what becomes trusted organizational truth.
No training on your data
Your content is used only to process your own requests. It is never used to train AI models, shared with other clients, or aggregated for any purpose.
Confidentiality levels
Records can be marked Sensitive (flagged in output) or Restricted (excluded from AI retrieval entirely). An admin-only review surface sits outside the main workspace.
PII minimization
IP addresses are stripped from stored records and never surfaced. We capture what serves organizational memory, not more.
Encrypted in transit and at rest
All service and datastore connections use TLS. Managed datastores are encrypted at rest. Secrets live only in the deployment environment, never in source code.
02: Access and authentication
Least privilege by default.
Every credential in the system is scoped, revocable, and designed so a single compromised token cannot cascade into a wider breach.
Constant-time token auth on the API, with request size limits and per-IP plus global rate limiting on all public endpoints.
Per-connection tokens for AI connectors Each integration token (e.g., Claude) is individually revocable and survives a master-secret rotation. No integration stores a shared master credential.
Hashed credentials Dashboard passwords are stored with scrypt and a per-user salt. Password changes and deactivations invalidate sessions immediately.
Scoped per-user Google connections. When a person connects their own Google account, the system is built so it can act only on that person's own account, never another's.
Per-tenant spend caps bound AI usage and contain any runaway or abusive activity.
03: Reliability and change management
No code reaches production without passing every gate.
The pipeline that protects your memory operates the same way the memory system itself does: nothing becomes trusted without review.
Every change passes a type-check gate, an end-to-end smoke suite, and a behavioral evaluation of the assistant run against a sandbox environment before release.
Deploys roll out in stages: sandbox to staging to production, each behind a health gate. Production is never released without passing the earlier gates.
Every service publishes a health endpoint reporting its running release, monitored continuously. Deploys are health-gated.
04: Subprocessors
Every third party we use to deliver the service.
Saberra does not use any subprocessors beyond this list. Changes to the list are communicated to active customers before they take effect.
AnthropicAI extraction and Q&A
Google WorkspaceMeeting assets and connectors
AssemblyAIOptional transcription
NotionCustomer-facing datastore
RailwayHosting and managed Postgres
05: Data portability and exit
If Saberra ceased operating tonight, your records would be fine.
The most important trust property in a memory system is what happens when it stops.
Your records live in your Notion workspace, under your account. Saberra writes to Notion; it does not hold copies. Cancel on any day and every record captured to that point remains in your workspace, readable, searchable, and yours. No export required. No migration required. No request to Saberra needed.
No notice period. No exit fee. No minimum term. Month-to-month. Cancel from the dashboard or by emailing security@saberra.com. Unused prepaid days are refunded pro-rata.
You may revoke Saberra's integration access at any time. Before or after cancellation. When you revoke, Saberra stops reading and writing immediately. Your records stay.
These terms are a reserved matter. They cannot be reduced without independent Steward consent under governance document 01. A policy written only in terms of service can be changed whenever the company decides to. This one can't.
06: Business continuity
What happens if Saberra's founder is unavailable.
The honest version: the company depends on one person, records are already protected by architecture, and the plan handles the rest.
Record protection does not depend on continuity. Because records are in your workspace under your account, they are safe regardless of what happens to Saberra. The continuity plan governs billing, communication, and wind-down, not record survival.
A Steward holds continuity access. An independent third party, not an employee or investor, holds credential escrow with a 30-day waiting period. If the founder is unreachable for 30 days, the Steward requests access, notifies customers, suspends billing, and executes wind-down on stated terms. Full protocol: governance document 02.
What customers are told in a continuity event: what happened, that their records are unaffected, whether capture is continuing, that billing is suspended from that day, and the date by which a decision will be made. No softening. The document requires plain language.
07: Retention and residency
What Saberra holds and for how long.
Records in your Notion workspace follow Notion's retention policies, not Saberra's. Saberra's own operational data is subject to what follows.
Operational events: heartbeat events 7 days; all other processing events 90 days or 500 rows, whichever is smaller. The row cap is the binding limit. It exists so operational data cannot accumulate indefinitely on any plan.
Email dedup metadata (the record that a given message was already processed) is held for the duration of the contract, then deleted. It is not the email content; it is a hash used to prevent double-extraction.
Deletion requests are fulfilled within 30 days for all Saberra-held operational data. Email security@saberra.com. Saberra cannot delete from your Notion workspace. That is your action, in your account.
Data residency: Saberra's hosted services run on Railway (US). Your Notion workspace residency is governed by your Notion plan and region, not by Saberra. The subprocessor list shows every party that touches data in transit.
Security incidents: Saberra notifies affected customers within 72 hours of confirming a breach affecting their data. The notification includes what was accessed, when, and what Saberra is doing. Notification goes to the account email on file. There is no public dashboard; contact security@saberra.com for status during a declared incident.
Documents and contact
The Data Processing Agreement is available directly below. Current subprocessor list is embedded in the DPA. Security questionnaires are welcome at security@saberra.com.