Who can read our pipeline and our transcripts
Growth-OS holds what customers said to us, our pipeline and our numbers. This page says where that lives, who can open it, what the server refuses, and what stays a human responsibility.
What the server enforces
Your role is resolved on the server
Clerk says who you are. Which project and which role that gives you is resolved on the server. The browser cannot send a project or a role along and expect it to be believed.
One path for every write
Every saved change goes through a shared contract and a transaction that rechecks the project. A save sent twice returns the original result instead of writing a second record.
Live updates read only your project
Realtime runs through an authenticated proxy with fixed tables, fixed columns and a project filter the server owns. It is a read channel, never a way to write.
Failures name the problem, not the data
A failure gets a stable code and a reference support can look up. The detail stays with the server, the audit history and Sentry.
Where our data lives
Everything that persists sits in one PostgreSQL database on Railway: accounts, meetings with their transcripts, evidence, decisions, objectives and the finance pages. The database is not exposed on the public internet; the application and Electric reach it over private networking. Migrations are generated, read and applied deliberately, never quietly on boot.
Redis runs beside it for work that waits or has to be retried, such as extracting a transcript. Those jobs re-read ownership before they write anything, because a job carries no person with it.
How roles work
A role applies per organization or per project, and an explicit project role overrides what you have organization-wide.
- Owner: reads and edits everything, manages the team and Finance, and transfers ownership through its own separate command.
- Founder or admin: reads and edits, manages within the granted scope, and can open Finance.
- Editor: reads and edits the everyday work. No team management, and no Finance, which includes salaries.
- Advisory or viewer: reads, comments and casts the votes they are eligible for. Edits nothing.
Decision voting uses exact role groups independently of rank: being an admin does not give you a vote in a founders-only poll. A role change applies from the next request onward. What somebody already read cannot be taken back.
What the server refuses
- Saving evidence whose quote is not literally present in the linked transcript.
- Storing an extraction proposal whose character span does not check out.
- Linking a record in one project to another. The database makes that unrepresentable, not just the code.
- Freezing a campaign whose audience rules cannot be parsed. It refuses rather than widening back to everyone.
- Treating an unknown role, source or provider as allowed. Unknown means no.
- Sending anything. Growth-OS does not email, message or contact anyone.
What a source connection stores
An API key you connect on the Sources page goes to the platform connection store, not to a second store owned by Growth-OS. The key is encrypted at rest, and the encrypted envelope repeats the project it belongs to, so a key moved to another row fails to decrypt instead of decrypting into the wrong place. The encrypted value is in no read query and never returns to the browser.
Rotating a key raises its version and clears the earlier verification, so work that approved the old key conflicts instead of quietly continuing. Revoking empties the value under a database check. The Sources page shows, per source, what it would read, what it may write back, and whether this project has a connection for it.
Services that see our data
- Railway for hosting, PostgreSQL and Redis
- Clerk for signing in
- Electric for authorized live updates
- OpenAI for the models behind extraction, Ask Growth Kit and generated content
- Sentry for error reports
- PostHog for consent-aware product analytics
- Any source one of us connects on the Sources page
What stays a human responsibility
Growth-OS carries no certification and no external audit, and this page does not pretend otherwise. What is written here is what the code does. Who gets which role, which sources we connect, which transcripts we keep and for how long, and what we tell a customer before recording them are our decisions, not the software’s.
If you see something that should not be there, or you can open something you should not, email [email protected] rather than waiting for the next stand-up.
A question about access or a transcript?
Ask the people who run Growth-OS. An answer beats an assumption.