Privacy Policy

Each firm that creates a workspace decides what goes into it and is the controller of that information, including the vendor records it enters, the documents it uploads, and the answers its vendors submit. Alles hosts and processes that information on the firm's behalf and does not use it for its own purposes beyond running and securing the tool. If you want something a firm entered about you or your company changed or removed, the firm is the right place to ask; we will help the firm carry that out.

Account information. When you sign in, our authentication provider processes your name, email address, and firm membership so we can create and secure your account.

Firm and vendor records. What a firm enters: vendor names, contacts, categories, contract and renewal details, whether a vendor touches client information, diligence notes, uploaded vendor documents (such as SOC 2 reports or contracts), and generated reports.

Questionnaire responses. When a firm sends a vendor a questionnaire link, the person who answers provides their name, title, work email, and answers. We record when the link was opened and completed. That information belongs to the firm's record for that vendor.

Email you send through the tool. If you connect your Microsoft 365 mailbox, our authentication provider holds a Microsoft token that lets the tool send email as you. The permission is send-only: the tool does not read your mailbox. For every email the tool sends, redirects in test mode, or blocks, we log the recipient, subject, time, who sent or approved it, and the outcome, so your firm has a record and the safety limits can be enforced. We do not keep a copy of the message body beyond what your own Sent Items folder holds.

Technical data. Standard logs (IP address, browser, timestamps, error data) used to operate and secure the tool, and delivery logs for the webhooks a firm configures.

To provide and secure the tool, authenticate users, keep each firm's workspace separate, deliver the notifications a firm sets up, respond to support requests, and meet legal obligations. We do not sell personal information and do not use firm, vendor, or respondent data for advertising or to train AI models.

The tool uses a third-party AI provider (currently OpenAI) through its business API, which by its terms does not use the content to train models. What is sent depends on the feature.

Vendor research: the vendor's name, website, trust center link, and category. The provider searches the public web and returns notes with sources. No firm data goes into research.

Review drafting: those research notes plus, from the firm's record, how the firm describes the vendor, whether the vendor touches client information, and whether the firm holds a SOC 2 report and a breach-notification clause, so the review is written for the firm's own use. A verification step may open the public page the draft cites.

Document reading: the text of a vendor document the firm uploads, when the firm has turned document reading on.

Firms control these features in Settings. Automatic research and drafting of new vendors and the agent workflow are off until a firm turns them on; a person can still start a draft for a single vendor, and document reading is off for new firms until turned on. Output is a proposal only; the firm decides whether to accept it. We ask firms not to upload documents containing their clients' personal information.

Many firms review the same vendors. To save each one from repeating the work, the tool shares facts about a vendor across firms: that a SOC 2 report exists and the period it covers, a public trust center link, how many firms track the vendor, and how the vendor answered multiple-choice questionnaire questions. AI research notes about a vendor, which come only from public sources, are also reused across firms for a limited period. Shared role mailboxes a vendor publishes on its own domain (such as security@ or privacy@), found by that research or confirmed by a firm, are offered to other firms as suggested contacts; a named person's address is never shared. A vendor filling in a new questionnaire is also offered its own earlier answers. Nothing a firm uploads or writes is shared: no documents, no notes, no reviews, no free-text answers, and never which firm the information came from.

A firm may configure the tool to send event notifications to destinations it chooses, such as Slack, Microsoft Teams, or its own systems. Those messages contain the event data the firm selected and are governed by the receiving service's own policies. Alles is not responsible for destinations a firm configures.

We use a small set of providers to run the tool: Clerk for authentication, Railway for hosting and the database, OpenAI for the AI features, and Microsoft (Microsoft Graph) to send the email you send or approve from your own mailbox. They process data on our behalf under their own security and privacy commitments. We will give reasonable notice of material changes to this list.

Data is hosted in the United States. The tool is a beta and is provided without any security guarantee. We use encryption in transit, access controls, and per-firm isolation so one firm's data is not visible to another. Questionnaire links are long random tokens and stop working once a response is submitted or the firm withdraws the link. No method of transmission or storage is perfectly secure, and the tool is provided without any security guarantee; see the Terms of Service.

The tool is designed to hold vendor records and oversight documentation, not a firm's underlying client information. Firms are responsible for ensuring that what they enter is appropriate and permitted under their own client agreements and regulatory obligations.

Data stays in a workspace for as long as the firm keeps it there. Firms can delete vendors, documents, and questionnaire requests themselves. When a workspace closes, or on a firm's request, we will delete or return the firm's data within a reasonable period, except where retention is required by law. Because the tool is offered free and may change or end, firms should keep their own exports of anything they need to retain.

Firm users can access, correct, export, or delete their firm's data in the application, or by writing to privacy@allestechnology.com. Vendor respondents should contact the firm that sent the questionnaire; we will act on the firm's instructions and will also respond to direct requests where the law requires.

We may update this policy as the tool evolves. Material changes will be posted here with an updated date.