Legal

Security

Last updated: September 23, 2026

Assistly is operated by Zigzag Technologies. This page describes how we protect customer data and how to report a vulnerability. We do not run a paid bug bounty, but we read every report and reply to each one.

1. Reporting a vulnerability

Email support@tryassistly.com with “Security” in the subject. Include what you found, where, the steps to reproduce it, and what an attacker could do with it. We acknowledge reports within two business days, tell you when we have confirmed the issue, and let you know when it is fixed. Please give us a reasonable time to fix an issue before discussing it publicly.

2. Scope

The Assistly desktop app for macOS and Windows, and the iOS app.
The web app at app.tryassistly.com and the API at api.tryassistly.com.
The Slack integration: the Assistly Slack app, its OAuth flow, event handling, slash command, and everything it posts or reads in a workspace.
The Google Calendar connection and the MCP server.
This website.

Out of scope: denial-of-service testing, social engineering of our staff or customers, physical attacks, findings in third-party services we use that we cannot fix ourselves (report those to the provider), and automated scanner output with no demonstrated impact.

3. Rules for testing

Test only against accounts and workspaces you own or have permission to use.
Do not access, modify, or delete other people’s data.
Stop and report as soon as you have shown that an issue exists.
Do not use a finding to pivot further into our systems.

If you follow these rules and report in good faith, we will not pursue legal action against you for the research, and we will work with you on disclosure.

4. How we protect data

All traffic is encrypted in transit with TLS 1.2 or higher.
Data at rest is encrypted by our hosting providers. Servers run on Amazon Web Services and the database on Supabase, both in the United States.
Secrets and third-party tokens, including Slack bot tokens, are stored server-side in a managed secrets store and never appear in client code, logs, or repositories.
Requests from Slack are verified with the app’s signing secret before they are processed, and the OAuth flow uses a signed state parameter.
The Slack bot can read only channels it has been explicitly added to, and a channel is searchable only by members of that channel who have connected Assistly.
Meeting audio is streamed to our speech-to-text provider for transcription and is not stored by us. What a session produces (the transcript, answers, recap, and any screenshots you asked Assistly to take) is stored encrypted with your account until you delete it. Customer data is never used to train AI models.
Production access is limited to the engineering team.

5. Incidents

If we confirm a security incident that affects customer data, we notify the affected customers by email without undue delay, and we notify Slack through its Help Center when Slack data is involved. Where the law requires it, we notify the relevant data protection authority within 72 hours of becoming aware of a personal data breach. Business customers are notified within 48 hours, as set out in our Data Processing Addendum.