Security
This page describes selected implementation details. It is not a complete security policy or confirmation that every security control has been independently verified. A workspace is hosted by Excelsius by default or can use a Notion workspace you choose. Hosted workspaces are isolated per business with row-level security. Connection tokens you grant, including an optional Typefully connection, are encrypted at rest. You can export a hosted workspace as Markdown and CSV, and a hosted workspace can be moved to your own Notion.
Connection tokens
Connection tokens are encrypted at rest using AES-256-GCM. The encryption key is configured server-side.
Provider permissions
Permissions vary by provider and connection. Review the permission request shown by the provider before granting access.
Hosting and service providers
- Excelsius-hosted workspace: stored in Excelsius's database and isolated per business with row-level security.
- Notion workspace: Notion can be selected as the workspace home.
- Service providers named in the current implementation: Vercel, Supabase, Stripe, Anthropic, and Google. This is a partial list and may omit other services or details about how they handle data.
Payment processing
Excelsius subscription checkout uses Stripe.
Disclosure
If you discover a security issue with Excelsius, please report it to support@excelsius.co with the subject “Security:” followed by a short description.
Subprocessors
The following service providers are named in the current implementation. This list is partial and may omit other services or details about how they handle data.
- Vercel — hosting
- Supabase — application database and authentication
- Stripe — subscription checkout
- Anthropic — language model API
- Google — Calendar and Gmail connections
Contact
Security questions or reports: support@excelsius.co