Security

Last updated September 26, 2026

Decize stores an organization’s decision record. We protect it with workspace isolation, explicit membership, and narrowly scoped integrations.

  1. Where your log is stored

    Your decision log is stored in a Supabase Postgres database in AWS us-east-1 (N. Virginia). Supabase encrypts stored data at rest with AES-256 (supabase.com/security). Email sent to your capture address, and the email Decize sends, pass through Resend in AWS ap-northeast-1 (Tokyo). This is where data is kept today, not a data-residency commitment; the Privacy Policy lists where copies are kept.

  2. Encrypted transport

    Every page and API call between your browser and Decize runs over HTTPS.

  3. Organization isolation

    Decision records require an organization identity. Row-level security separates workspaces on reads, and server-side code scopes each write to its workspace.

  4. Role-based access

    Authenticated membership and organization roles control access to management, settings, analytics, and exports.

  5. Audited operations

    Sensitive organization changes create audit events, and signed action links are verified before writes.

  6. Controlled capture

    Inbound email capture resolves senders to organization members and applies allowlists and rate limits. Replies go only to your teammates, never to outsiders on the thread. A first-time sender on your allowlisted domain is told only that their email wasn’t saved yet.

What it takes to get an email in

Every gate below is enforced in code today. The numbers are the real constants.

  1. Signature

    Mail arrives only through a webhook that must prove it came from our mail provider — a signature over the exact bytes received, or a shared secret — checked before anything is parsed.

    reject unverified

  2. Address token

    The capture address carries a secret token. A retired token works for 30 days, then stops.

    8 characters

  3. Sender

    On your roster, and the mail passes its domain’s email authentication (DMARC where the domain publishes it, otherwise an aligned DKIM or SPF pass)? Accepted. Everyone else — including someone whose domain you allowlisted — is refused and reported to the owner.

    default deny

  4. New senders

    Nobody joins your roster without an owner or manager. A first-time sender on your allowlisted domain is queued for approval and, while sender confirmations are on, told at most once a day that nothing was saved yet. A verified outsider, say a contractor who replied-all on a thread you Cc’d, is refused but listed in the owner’s daily summary too. Either can be added from it with a tap and a confirm (the link lasts 7 days). A removed member can’t be added this way; they’re re-added from the Manage page. Once added, they can ask the capture address about past decisions right away, with no sign-in (while answering is on), and can read every decision once they sign in. The refused message isn’t replayed, so they send it again.

    owner or manager approves

  5. Machine mail

    Auto-replies, out-of-office autoresponders, bounces and Decize’s own replies are dropped before triage.

    no loops

  6. Volume

    A hard ceiling on how many messages one workspace will accept in a day.

    200 / day

  7. Is it even a decision?

    Below the confidence floor, or structurally unusable, nothing is written to the ledger. Precision over recall.

    0.6 floor

  8. Scope of a reply

    A reply can only patch a decision logged from its own thread, or a near-identical one Decize matched itself — the sender cannot steer it at another record.

    thread or 0.9 match

  9. Decize talking back

    Silence is the default: uninvited, it speaks only on a real change, at most once per thread per day (a receipt asking you to confirm that a new decision replaces an earlier one is exempt from that limit), or to say a decision or update it found could not be saved (for example, a due date is required). An owner or manager can switch the confirmations off; the could-not-save notice and the review of forwarded meeting notes still go out, within the daily ceiling.

    20 / day

  10. Answering a question

    Ask the capture address what the team already decided and it answers from recorded decisions only, to the asker alone. On by default (an owner or manager can turn it off), and never sent unless the message passes SPF, DKIM or DMARC — an unverified From is refused, so a forged sender can’t use the address to read your ledger.

    on · verified sender

AI and integrations

AI drafting goes to Google Gemini first, and to Anthropic only if Gemini fails. Related past decisions are found in two steps: our database provider picks the closest few, then the same AI provider checks each close pair once, with both titles, the newer decision’s summary and the earlier one’s date, outcome and lesson. Decize keeps the answer, so a pair is not sent twice. We don’t train AI models on your decisions. The email integration processes messages only when they are sent or forwarded to a workspace capture address. See our Privacy Policy for the full provider list.

What the API exposes

A workspace owner can connect an AI assistant (Claude, ChatGPT, Copilot) to Decize over the Model Context Protocol. The assistant uses a key the owner created in Settings, and it sees only that workspace:

  • Decision titles and summaries, owners’ names, deadlines, status, whether a decision is still in force and what replaced it, and recorded outcomes with their reasons, notes and lessons. Never the emails a decision was captured from, beyond the decision’s own lines.
  • Keys are shown once and stored only as a one-way hash. The owner can revoke a key at any time, and its next call is refused. Each key may make at most 30 calls a minute.
  • An assistant can read, and, only if the owner allows it, suggest a decision. A suggestion is never recorded on its own: an owner or manager keeps or dismisses it in Decize.
  • Answers tell the assistant that decision text is the team’s own words, to be treated as data and not as instructions.

Organization controls

  • Owners and managers can manage the roster and organization settings.
  • Owners and managers can export the whole ledger, and the activity log, in portable formats on every plan.
  • Decision records can be updated or deleted by authorized members.
  • Owners can delete the entire workspace themselves, anytime, from Settings.
  • Owners can choose how long Decize keeps the text of emails sent to it: 30, 90 or 365 days, or with no time limit, which is the default. Decisions, outcomes and lessons are kept either way.
  • Subprocessors. Every provider that handles your data, what it touches and where, is listed in our Privacy Policy.
  • Data processing agreement. We do not have a DPA document yet. If your review needs one, email support@decize.app and we will tell you when it will be ready.

How long data is kept

  • Decisions, outcomes and lessons are never deleted on a schedule. A decision stays until an owner or manager deletes it, or the workspace is deleted.
  • Deleting a decision erases the text of the emails linked to it: the email it was captured from, replies in that thread that changed it or reported how it went, and the meeting notes it was kept from. Other emails that mention it, and a record that each email arrived (sender, date and subject), stay until the workspace is deleted, unless an owner has set a retention period for email text.
  • Emails sent to Decize that do not become a decision, including meeting-note suggestions nobody kept, keep their text until the workspace is deleted, or for 30, 90 or 365 days if an owner sets that retention period in Settings. For a sender who is not approved, Decize stores only the sender, address, subject and date.
  • Our database host keeps daily backups for 7 days, so data you delete can stay in a backup for up to about 8 days.
  • Resend, which sends our emails and receives mail at your capture address, keeps that mail's content and delivery logs for 30 days.

Reporting a vulnerability

Send security reports to support@decize.app, including reproduction steps where possible. Please allow a reasonable period for investigation before public disclosure. Decize does not currently operate a paid bug-bounty program.

Limits

Decize is in beta. We have no SOC 2 audit and no penetration test yet. No online service can guarantee perfect security; we continue to review access controls, dependencies, and operational safeguards as the service evolves.

For the definitions and sample rules behind decision-health reporting, see the decision quality methodology.