Three promises
The ones customers ask about first: can Twiggy see our models, and would we know?
We don’t read your models
Our staff don’t open customer models. Not to browse, not to debug, not to help, unless you ask us to in writing, and then only for that request. Our own admin tools are built so they can’t show model content, and an automated check stops that from ever changing.
If we touch your workspace, you’ll see it
Anything our staff do to your workspace or your people, such as changing a plan or blocking an account, is written into your own audit log, under our name. You don’t have to take our word for it.
Production access is the exception
Only a very small number of named people can reach production systems, with two-step sign-in, and only for an incident or a request from you. Every use is recorded.
How we protect your work
Layers, not a single lock. We describe what each one does, and keep the detail of how to ourselves: there is no reason to hand an attacker a map.
Sign-in that resists theft
No passwords to leak or reuse: single-use email links, and passkeys (your fingerprint, face or device PIN) that can’t be phished. Two-step sign-in with a passkey or an authenticator app, which admins can require of everyone or of admins only, with devices remembered for as long as you choose. Admins can also end every session at once and limit the workspace to your organisation’s email domains.
Your data kept apart
Every request is checked against the workspace it belongs to. Separation between customers is tested automatically, by trying to reach one customer’s data as another.
Access you control
Roles from viewer to owner, owned and restricted folders, and sign-off rules decide who can see, edit and approve each model. The AI only ever sees what the person using it may see, and you can switch it off.
Encrypted in transit and at rest
HTTPS everywhere, enforced by the browser. Data and backups encrypted at rest by our hosting providers, and the most sensitive secrets sealed again by the application itself.
A record of what happened
An audit log of sign-offs, access and rule changes, people and security events, with retention you set. Every model keeps its version history, so nothing is lost and any change can be undone.
Built carefully, kept current
Dependencies monitored and patched as advisories appear, and automated checks on every change before it ships, including that every route verifies who is calling.
AI with boundaries
Models go to the AI only when someone with access asks it to work, through a provider that doesn’t train on that data. Interviews are kept with the model, nowhere else.
Ready when something goes wrong
Backups with point-in-time recovery, so data can be brought back to a moment before a problem, and a promise to tell affected customers quickly and plainly.
Where your data goes
One picture of the whole flow. Nothing else receives your models.
Your people
Twiggy application
Database and backups
AI, only when asked
Payments
| Provider | What for | Where | What it handles |
|---|---|---|---|
| Vercel | Runs the application | United States (US East, Washington, D.C.) | Everything the app serves, while it serves it |
| Neon | The database and its backups | United States (AWS US East 1, N. Virginia) | Workspaces, models, registers, sign-offs, audit log |
| Anthropic | The AI (Claude, commercial API) | United States | The model text and conversation, only while the AI works on a request; not used for training |
| Stripe | Payments | Global | Billing details; card numbers go to Stripe, never to us |
| Resend | United States | Email addresses and the sign-in and sign-off links we send |
What’s available, and what’s coming
So your security team knows exactly what they are getting today.
| Email-link and passkey sign-in, two-step sign-in | Available now | Every plan; admins can require two-step of everyone on Team |
| Roles, owned and restricted folders, sign-off rules | Available now | Team and Corporate |
| Audit log with retention you set, version history | Available now | Every plan |
| AI switched off per workspace | Available now | Every plan |
| Export every model as plain text, any time | Available now | Every plan |
| Single sign-on (OpenID Connect: Entra ID, Okta, Google) | Corporate | Available now, set up with you |
| Organisation workspaces and shared registers | Corporate | Available now |
| Dedicated hosting in your region (for example Australia) | Corporate | A deployment of its own, by arrangement |
| Encryption with keys you hold (bring your own key) | Roadmap | Planned, with dedicated hosting |
| IP allow-listing | Roadmap | Planned |
| Independent penetration test and security pack download | Roadmap | Planned; the pack is available under NDA today |
For corporate customers
Your risk and IT teams will want more than a web page. They can have it.
The detail, on request
Under a confidentiality agreement we share our security controls, architecture and data flows, our list of subprocessors, our data access policy, and answers to your security questionnaire. Ask through the contact page and say you need the security pack.
Corporate, today and next
Available now: single sign-on through your identity provider, organisation workspaces, and a dedicated deployment in the region you choose. Coming: encryption with keys held in your own cloud account (revoke the key and your data can no longer be read, by anyone) and IP allow-listing.
Found a vulnerability?
Tell us at security@twiggymodeller.com before telling anyone else, with enough detail for us to reproduce it. We’ll acknowledge it quickly, keep you updated, and won’t pursue anyone who reports in good faith and doesn’t touch other people’s data.
Questions from your security team?
Send them over. A person who knows the system will answer, not a template.