Skip to content
Plymouth AI Lab
Book a call

Security

How we keep it safe

Small AI systems are only useful if you can trust them. These are the rules we work by, proven first on our own site and newsletter.

Security

Plugs into your stack.
Asks before it acts.

The systems we build use tools you already trust, with a person in the loop for anything that leaves the building.

Two real flows. A change: an agent drafts code or a message, it goes to a GitHub branch with full history, then a private Vercel preview, then a person approves, and only then it goes live. A subscriber: the signup form calls a Vercel function that reads its keys from the environment vault, Resend emails a signed confirmation link that expires in 48 hours, and the reader is only added to the list after confirming.A CHANGE OR A MESSAGEAgent draftsCODE OR MESSAGEGitHub branchFULL HISTORYVercel previewPRIVATEYou approveYES / NOLivePRODUCTION / SENDA NEW SUBSCRIBERSignup formEMAIL ONLYVercel functionKEYS FROM ENV VAULTResend emailSIGNED LINK, 48 HReader confirmsTHEIR OWN YESNewsletter listUNSUBSCRIBE: 1 CLICKA CHANGEAgent draftsCODE OR MESSAGEGitHub branchFULL HISTORYVercel previewPRIVATEYou approveYES / NOLivePRODUCTION / SENDA SUBSCRIBERSignup formEMAIL ONLYVercel functionKEYS FROM ENVResend emailSIGNED, 48 HReader confirmsTHEIR OWN YESList1-CLICK UNSUB

  1. A person approves every action01

    Agents draft and propose. Nothing an agent prepares is sent, posted, paid for, published or deleted until a person on the team says yes.

  2. Signups confirm themselves02

    A new subscriber is only added after they click a signed confirmation link, which expires after 48 hours. Unsubscribe is one click.

  3. Keys stay in the vault03

    API keys live as encrypted environment variables on the hosting platform. Never in code, chat or documents.

  4. Your data stays yours04

    We collect only what the job needs and share it only with the services that run it. We do not sell it.

  5. Every change is written down05

    Every code change lands in Git with its full history, and important decisions go into a written log.

  6. Preview first, then your call06

    Changes ship to a private preview first. Production only follows an explicit approval.

    Private previewApprovalProduction

Works with

  • Vercel
  • GitHub
  • Resend
  • Google Workspace

Human approval for agent sends: always

Our commitments

Seven rules we do not bend.

  • No message goes out without a yes. Every email, post, text or chat message an agent drafts waits for a person on the team to approve it.
  • No spending without a yes. Purchases, charges and anything that touches a card wait for explicit approval.
  • No deleting without a yes. Files, accounts, keys and projects are only removed after the owner approves the exact list.
  • No keys in the open. Keys are stored as encrypted environment variables and never pasted into code, chat or documents.
  • No silent signups. Nobody joins a list until they click their own signed confirmation link.
  • No data resale. We collect only what the job needs, share it only with the services that run it, and never sell it.
  • No badges we have not earned. We do not claim certifications we do not hold. Ask us anything and we will show you how it works.

Questions about how a build handles your data? Email alfredo@plymouthlab.com.