Security and data
The short version: your data stays in your accounts, and nothing reaches a customer without a person approving it.
How your data is handled
Runs in your accounts
Workflows run in your n8n, Google and OpenAI accounts. Your customers' emails, CVs and invoices never pass through PlugStaff.
Drafts by default
Anything that reaches a customer, candidate or prospect is a draft a person approves. Nothing is sent on its own.
Rules enforced in code
Refunds, complaints, legal threats and low-confidence answers escalate to a person. That check lives in the workflow, not only in the prompt.
Your keys, your audit trail
You hold every credential and can revoke it any time. Each item is logged in your sheet with a status and reason.
Where your data goes
Each AI employee is a workflow that runs in your n8n instance (cloud or self-hosted) and calls your Google and OpenAI accounts. The text it processes (emails, CVs, invoices, lead websites) goes from your n8n to your AI provider under your account's terms. PlugStaff never receives it.
What PlugStaff does hold
- Your account email and subscription status (via Stripe; we never see your full card number).
- Messages you send us.
See the privacy policy for the full list, legal bases and retention.
Guardrails built into every employee
- Drafts, not sends. Outputs land as Gmail drafts or sheet rows.
- Escalation in code. Sensitive categories and low-confidence answers go to a person by rule.
- Grounded prompts. Models are told to use only the inputs given (your KB, the prospect's site, the CV) and never invent facts.
- Logs. Every item gets a status and a reason in your sheet.
Your responsibilities
You decide what data to process and you remain its controller. Mention AI-assisted processing in your own privacy notice, keep secrets out of knowledge bases, and review outputs before sending. If you serve EU users and later let an employee reply automatically, tell people they're talking to an AI (EU AI Act transparency duties).