# Security and privacy

> How Tidy keeps each company's data separate, how AI agents act as you, and what stays human-approved.

Source: https://automatedconstruction.io/tidy/docs/features/security-and-privacy
Section: Features

## Your company's data is walled off

Every company on Tidy is its own organization. Every record and file is tagged with your company, and the database itself only returns rows for the company of the person asking. Two companies on Tidy cannot see each other's bids, files, clients or people. Uploaded files are stored in a folder for your company, and storage rules enforce the same wall.

Inside a company, your team shares the business data (bids, clients, vendors) on purpose. Admins manage the team, billing and company settings. Workspaces are shared with their members.

## Everything runs as the signed-in person

The app, the Tidy agent and any AI agent you connect all act as you, with your permissions. Tidy does not use a master key for everyday work. When you connect Claude or ChatGPT over MCP, you sign in on Tidy's own consent page and the agent gets a token tied to you. You can **Disconnect** it any time in **Settings > Signed-in devices**.

## A person approves what goes out

- Agents cannot send email. Follow-ups, bid submissions, declines and RFI chasers are drafts until someone on your team sends them.
- Billing, team changes and company settings are human-only.
- Each agent action can be set to **Allow**, **Ask** or **Block** in Agent mode under **Skills & Plugins > Settings**.

## Sign-in and sessions

- Email and password, or Google for your company's email domains.
- Admins can deactivate a person, which ends every session, or sign them out of all devices.
- You can see and end your own sessions in Settings.

## Limits that stop abuse

Daily limits on email recipients, AI drafting and agent tokens apply on every plan. One email can go to at most 25 people. See [Plans and limits](https://automatedconstruction.io/tidy/docs/get-started/plans-and-limits#daily-limits-on-every-plan).

## AI providers

We use AI providers whose terms do not allow them to train their models on what you send. Error reports are scrubbed of personal data before they leave the app.

## What Tidy does not have yet

Single sign-on (SAML), two-factor authentication, an admin audit log and a SOC 2 report are not available today. If you need one of these, [talk to us](https://automatedconstruction.io/contact).

## Legal

- [Terms of Service](https://automatedconstruction.io/tidysub/terms)
- [Privacy Policy](https://automatedconstruction.io/tidysub/privacy)
- [Usage Policy](https://automatedconstruction.io/tidysub/usage-policy)