How we protect your data

Signing in

You sign in with a single-use link sent to your email. During the beta, only invited or approved email addresses can create an account.

Who can see what

• Your data is stored in a Supabase Postgres database. Every table has row-level security, so the database itself only returns rows you're allowed to see. The server checks your permissions again before every action.
• Workspaces are private to their members. Owners and editors can change content; viewers can only read and use it.
• If you can't see something, LoadMyAI answers as if it doesn't exist. Nobody can find out what other people store.
• Every change is recorded with who made it and when (ids and version numbers, not your text).

Your files

• Files go into a private storage bucket with no public access. The server hands a file out only after checking your access.
• Uploads are checked before they're kept: allowed file types only, the content must match the extension, and executables and macro-enabled documents are rejected. The limit is 25 MB per file.
• Downloads are served as attachments, so a file can't run as a web page in your browser.

Connecting AI apps

• Claude, ChatGPT, Cursor and other apps connect with OAuth. You sign in to LoadMyAI and approve each app on a consent screen. There is no secret link or key to leak.
• Each request from an AI app is checked: the token must be issued for LoadMyAI, unexpired, tied to a live sign-in, and not revoked.
• The connection is read-only. An AI app can read and search your assistants but can't change anything.
• Revoke anytime in Settings, then Connections. The app is cut off immediately.
• AI apps only receive published content, and only for assistants you're allowed to use. Drafts never leave the editor.

Secrets and logs

• The importer strips anything that looks like an API key or password from a pasted configuration, and warns you.
• Exports and copied prompts never include access tokens or LoadMyAI's own keys.
• Access tokens and invitation links are stored as hashes. Our logs record ids and error codes, never your documents.
• Sign-in, uploads, invitations and AI connections are rate limited.

Limits you should know

• Anyone who can use an assistant can read it. That includes its instructions and documents, through their AI app, a copied prompt or a ZIP. An AI app can also repeat the instructions it receives. Only share with people you trust.
• Your AI app decides how it uses what it reads. LoadMyAI sends instructions as tool results. They don't override the AI app's own rules.
• No malware scanning. Uploads are checked by type and content, but not scanned by an antivirus engine.
• Once content reaches an AI app, that provider's terms apply. Check how your AI provider handles chats and connected data.
• LoadMyAI hasn't had an independent security audit yet.

Reporting a problem

If you find a security issue, please tell us privately first. Our contact email address is being set up. It will be listed on the Contact page before public launch.

More: Privacy policy · FAQ