Security

Last updated: July 13, 2026

Goatomate runs goatomate.com, a community of builders shipping marketing and AI automations together. We hold as little personal data as we can, for as short a time as we can. This page summarises how we work. For a security questionnaire or our Data Processing Agreement, contact [email protected].

We are a small team. We describe our practices honestly and do not claim certifications we do not hold. We are not currently SOC 2 or ISO 27001 certified.

1. Where a build lives

When a separate written agreement includes a build, the work stays in the accounts named in that agreement. Operational data stays there, under that account's control, and does not need to live on our infrastructure.

2. Access to other systems

  • We request the least privilege necessary to do the work, and prefer scoped, role-based access over broad admin rights
  • Where possible we use time-boxed or project-scoped credentials that can be revoked when the engagement ends
  • We ask that credentials be shared through your own password or secrets vault rather than plain email or chat, and we store credentials only in a reputable password manager for the duration of the work
  • We enable multi-factor authentication on the accounts and tools we use
  • At the end of an engagement, we ask you to rotate or revoke any credentials that were shared with us

3. Handling of other people's data

We avoid copying someone else's data onto our own machines. When we must handle it to build or test a system, we minimise what we take, keep it only as long as needed, and delete it afterwards. We do not maintain a long-term store of that data on goatomate.com infrastructure.

4. Endpoint and Account Security

  • Work devices use full-disk encryption, a screen lock, and up-to-date operating systems and software
  • Accounts and tools are protected with strong, unique passwords stored in a password manager, plus multi-factor authentication
  • Communication with other systems uses encrypted connections (HTTPS/TLS, SSH)

5. This Website

The goatomate.com website is hosted on managed infrastructure and served over HTTPS. Lead and contact submissions are stored with our database provider and transmitted to us by email. The providers that support the site are listed on our Subprocessors page.

6. Incident Response

If we become aware of a security incident affecting your data or systems, we will notify you without undue delay, share what we reasonably know, and work with you to contain and remediate it. Because deliverables run in your accounts, you retain your own platforms' native logging and alerting, which we are happy to help configure.

7. Responsible Disclosure

If you discover a security vulnerability in this website, please report it responsibly to [email protected]. Please do not exploit the issue or disclose it publicly before we have had a chance to address it. We will acknowledge your report and work with you to resolve it, and we appreciate the efforts of security researchers who help keep our site safe.