Your accounts stay yours
Commands.io acts in your email, calendar and business apps, so how it handles access matters. Here’s what we do, in plain language.
Sign in, no shared passwords
Most apps connect through their own sign-in, so you type your password into Google, Slack or HubSpot, never into Commands.io. Only an IMAP inbox or your own API needs a password or key pasted once.
Credentials encrypted with a dedicated key
Sign-in tokens, API keys and app passwords are encrypted with a dedicated Google Cloud KMS key before they’re stored.
Approve before anything is sent
Any command can ask first. Drafts wait in your Inbox until you approve, edit or skip them.
Every run on record
Activity shows each run, each step and what it did. When something fails, you get an alert saying what went wrong.
Only the accounts you name
A command only uses the apps in its steps. If you have two accounts of the same app, it asks which one instead of guessing.
Outside text is treated as data
Text from emails, web pages and messages is handled as data, not as instructions, which makes it much harder for a crafted email to steer a command.
Hosted on Google Cloud
The app runs on Google Cloud and Firebase, with data stored in the United States. Google processes it only as our infrastructure provider.
Payments by a specialist
Checkout and billing run through our payment provider. We never see or store your full card number.
Team access you control
Invite teammates into a workspace. Remove someone and their access ends straight away.
Leave whenever you like
- Disconnect any app from Connections whenever you like. Commands that need it stop working until you reconnect.
- Pause or delete any command in one click.
- Ask for a copy of your data, or for your account and data to be deleted, at contact@legal.commands.io.
- We don’t sell your data to advertisers, and we don’t train AI models on it.
Report a vulnerability
Email report@legal.commands.io with what you found and how to reproduce it. We read every report and reply to each one.
Security questions
No. The text a command needs is sent to our AI providers to understand commands and run AI steps. Under their API terms, they don’t use it to train their models either.