Your business data, protected by design

Alano holds your contacts, notes and sales pipeline — some of the most sensitive information a business owns. Here is exactly how it is handled, secured, and kept yours.

The short version

Who am I actually dealing with?

Alano is built and operated by Alano Tech Pte. Ltd., a company incorporated in Singapore. Security questions, data requests and vulnerability reports all reach us at hello@alano.ai.

Can another company see my data?

No. Every table that holds your records carries access rules checking which workspace you belong to before a single row is returned. The check runs inside the database, not in our app code — so it applies to the app, to the API, and to anything else that connects.

Do you train AI on my contacts?

No. We do not use your CRM data to train AI models — ours or anyone else's — without your explicit opt-in. When you use an AI feature, the relevant content goes to OpenAI to generate your answer, and nothing more.

What if I want to leave?

Export your contacts and CRM data, then delete your workspace. Your data is never held hostage, and we do not sell it.

Who at Alano can see my data?

A small number of staff can reach production for support and incident response, on a need-to-know basis. We would rather say that plainly than claim nobody can. Changes made inside a workspace land in its audit log either way.

What happens if something breaks?

Alano runs on managed, fault-tolerant infrastructure with automated backups and point-in-time recovery. If there is a service-affecting incident we investigate, tell the customers affected, and fix the cause.

Where is my data kept?

In standard PostgreSQL, managed by Supabase and running on AWS infrastructure. If your business needs data held somewhere specific, that is a deployment conversation — see the deployment options below.

The foundation we build on

Alano's database, authentication and file storage run on Supabase, whose managed platform runs on AWS. The database is standard PostgreSQL — not a proprietary fork — so the data model is an ordinary Postgres one, portable to anywhere that speaks it. Supabase is independently audited and certified, which means the infrastructure Alano sits on is held to those controls:

SOC 2 Type II
ISO/IEC 27001:2022

These certifications belong to our infrastructure provider. They cover the platform Alano runs on — not Alano's own application-level controls. We think that distinction matters enough to state it rather than let the badges imply otherwise.

Review them at the Supabase Trust Center

What Alano adds on top

Encryption in transit and at rest: Every connection to Alano uses TLS. Data on disk is encrypted by our infrastructure provider. Your contacts, notes and deals are not sent or stored as plain text.
Isolation enforced by the database: Row-Level Security is switched on across the application schema, with policies on every table that holds your records. Your workspace boundary is a rule PostgreSQL applies to every query, not a filter our code remembers to add.
Who sees what, down to the field: Access is set by role, by group, and per individual field. A group can be allowed to see a field without being able to change it, and restricted fields never leave the server in the first place.
An audit trail you can read: Database triggers record who changed what and when, with the value before and after. Entries can be added but not edited or deleted from the application, and you only see entries for records you already have access to.
Limits on the way in: Public API endpoints are rate limited per organization, with IP reputation tracking, block windows, and an optional allowlist for the addresses you expect traffic from.
Backups and recovery: Automated backups and point-in-time recovery run on the managed platform, so accidental loss is recoverable rather than final.

How the isolation actually works

AI and your data

We do not use your CRM data to train AI models — not ours, and not third-party models — without your explicit opt-in consent.

Alano's AI features are built on OpenAI. When you enrich a customer, generate a briefing or ask the assistant a question, the relevant content is sent to OpenAI purely to produce your response.
OpenAI processes it under their own data-processing terms, and we do not authorise them to train on your inputs.
We may use aggregated, anonymised usage data — which cannot identify you or your customers — to improve how the product performs.
AI output is there to assist judgment, not replace it. Verify anything that matters before acting on it.

Your data stays yours

At any point you can:

Export your contacts and CRM data
Delete your workspace or your account
Ask what personal data we hold about you, and have it corrected
Ask us to delete your personal data

We do not sell your data. To exercise any of these, email hello@alano.ai — we respond within 30 days.

Who is responsible for what, under GDPR

Where Alano can run

Most customers use the shared cloud, and nothing here needs a decision from you. If your organisation cannot put customer data on a shared platform, Alano can also be delivered as a dedicated project or built to run entirely inside your own network.

On-premise is a scoped engagement rather than a download — the database schema, the access rules and the audit engine carry over unchanged, while sign-in, email and AI features change to suit an isolated environment.

Compare the three deployment options

Report a vulnerability

If you believe you have found a security vulnerability in Alano, email hello@alano.ai with enough detail to reproduce it. We aim to acknowledge within two business days and will keep you updated while we investigate.

In scope: alano.ai, crm.alano.ai, auth.alano.ai, and the Alano CRM Chrome extension. Please do not run automated scanning that degrades service for other customers, do not access or modify data belonging to anyone else, and give us a reasonable chance to fix an issue before disclosing it. Report in good faith and we will not pursue action against you.

security.txt

Alano.ai