Security

ASUME is built for B2B teams that connect CRM data, internal notes, integrations, and public company signals in one workspace.

This page explains how security works in the product: who can access a workspace, how sign-in is controlled, and how customer data is isolated between tenants.

It is an operational guide for admins and security reviewers. It is not a substitute for our contractual Security Measures document, which describes ASUME's formal technical and organisational controls.

Each workspace is a separate tenant. Members only see objectives, sources, feed items, and output for workspaces they belong to.

Admins invite and remove users, assign roles, and control which integrations are connected. Viewer seats can limit who can change configuration or export data.

Team workspaces support secure sign-in through ASUME accounts or your identity provider.

Enterprise customers can enforce SSO-only access, map IdP groups to ASUME roles, and tighten session policies so directory changes revoke access promptly.

Customer workspace data, connected sources, prompts, and generated output are stored to power objectives, feed, lists, and collaboration features.

Data is encrypted in transit. Production systems use access controls so ASUME personnel can only reach customer content when necessary to operate, secure, troubleshoot, or support the service.

For how inference output, retention, and workspace isolation work in practice, see Data privacy.

Integrations extend what ASUME can read, but they also expand your attack surface. Admins choose which systems to connect and which scopes to grant.

Review integration permissions regularly, rotate credentials when staff change roles, and disconnect sources that are no longer needed.

If you believe your workspace or account has been compromised, contact us immediately so we can investigate and limit access.

Security researchers and customers can report vulnerabilities or suspicious behaviour to our security team. Include steps to reproduce, affected workspace or account, and any relevant timestamps.

Procurement, InfoSec, and legal teams usually need formal documents rather than product guides.

Security Measures describes ASUME's technical and organisational measures under contract. The Privacy Policy, Data Processing Agreement, and Subprocessor pages cover personal data processing and third-party providers.