Security

Last updated September 15, 2026

Attune is a small company handling data that brands care about. This page says plainly what we do to protect it, what we do not have yet, and how to reach us if you find a problem.

The short version

• In the common setup, Attune never holds your customers’ email addresses or phone numbers.
• Your customers’ personal data never goes into an AI prompt.
• Everything is encrypted in transit. Data at rest is encrypted by our hosting provider.
• One person has access to production today.
• We do not have a SOC 2 report yet. We say so rather than imply otherwise.

Where your data lives

Attune runs on Railway, with a managed Postgres database, in the US East region (Virginia). Our marketing site is hosted on Vercel, in the United States. Database backups are taken daily and kept for up to 90 days. Our full list of providers, and what each one sees, is on the Subprocessors page.

What we hold, and what we don’t

How much customer data Attune holds depends on how you send messages.

If you send through your own provider (Klaviyo, Attentive, PostScript), which is what most brands do, Attune stores a pseudonymous identifier for each customer, their order details, and where they are in a journey. When it is time to send, Attune hands your provider the identifier and the message. Your provider looks up the contact and sends. Attune never has the email address or phone number. If our database were compromised, an attacker would have order records with no way to contact anyone.

If Attune sends directly, we hold the email address or phone number needed to deliver, and we protect it as described on this page.

In both cases, if a customer replies to a message, we store the reply as text. People sometimes put an email address or phone number in a reply. We don’t scrub those out, and we treat replies as personal data.

AI and your customers’ data

Attune uses language models from Anthropic to understand products and draft messages. The prompts we send are about products: your listings, your guides, your brand voice, and public reviews and discussion of the product. They do not contain customer names, contact details, or order records. A message is drafted for a product and a moment, then matched to the right customer by our own systems at send time. Anthropic does not train on data sent through its API.

Encryption

All traffic to and from Attune uses TLS. Data at rest, including the database and backups, is encrypted by Railway. The API keys for providers you connect are encrypted in the database with Rails’ built-in encryption, and are never shown in the app after entry.

Access and authentication

Brand users sign in with a one-time code or a magic link sent to their email; there are no passwords to steal or reuse. Team members are invited by an admin of the account and can be deactivated at any time from settings.

Inside Attune, access to production systems is limited to the founder.

Development practices

Every change runs through automated tests and security checks in CI, and dependencies are checked for known vulnerabilities on every push. Staging and production are separate environments with separate credentials.

What we don’t have yet

We are early. We do not currently hold a SOC 2 report, an ISO 27001 certification, or a third-party penetration test. Our infrastructure providers hold their own certifications, which cover the layers they run. We expect to pursue a third-party assessment as the business grows, and we will update this page when we do. If your security review requires one of these today, tell us; we would rather know than have you guess.

Reporting a vulnerability

If you find a security issue in Attune, email security@attune.to. We will acknowledge within 2 business days, keep you informed while we fix it, and credit you if you want. Please do not access other people’s data or disrupt the service while testing, and give us a reasonable window to fix the issue before disclosing it.

Questions

Anything this page doesn’t answer, ask at support@attune.to. Security questionnaires are welcome; we will fill them in honestly, including the parts where the answer is “not yet.”