Your business data, protected by design

Alano holds your contacts, notes, sales pipeline and — with Omucloud — your email. Some of the most sensitive information a business owns. Here is exactly how it is handled, secured, and kept yours, across every product we operate.

The short version

Who am I actually dealing with?

Alano is built and operated by Alano Tech Pte. Ltd., a company incorporated in Singapore. Security questions, data requests and vulnerability reports all reach us at hello@alano.ai.

Can another company see my data?

No. Every table that holds your records carries access rules checking which workspace you belong to before a single row is returned. The check runs inside the database, not in our app code — so it applies to the app, to the API, and to anything else that connects.

Do you train AI on my contacts?

No. We do not use your CRM data to train AI models — ours or anyone else's — without your explicit opt-in. When you use an AI feature, the relevant content goes to OpenAI to generate your answer, and nothing more.

What if I want to leave?

Export your contacts and CRM data, then delete your workspace. Your data is never held hostage, and we do not sell it.

Who at Alano can see my data?

A small number of staff can reach production for support and incident response, on a need-to-know basis. We would rather say that plainly than claim nobody can. Changes made inside a workspace land in its audit log either way.

What happens if something breaks?

Alano runs on managed, fault-tolerant infrastructure with automated backups and point-in-time recovery. We target restoration in under four hours with at most fifteen minutes of data loss, and we grade, escalate and review incidents on a standard severity scale. If an incident affects you we tell you directly. The full picture — including a regional outage, which we could not recover from that quickly today — is on the resilience page.

Where is my data kept?

In standard PostgreSQL, managed by Supabase and running on AWS infrastructure. If your business needs data held somewhere specific, that is a deployment conversation — see the deployment options below.

The foundation we build on

Alano's database, authentication and file storage run on Supabase, whose managed platform runs on AWS. The database is standard PostgreSQL — not a proprietary fork — so the data model is an ordinary Postgres one, portable to anywhere that speaks it. Supabase is independently audited and certified, which means the infrastructure Alano sits on is held to those controls:

SOC 2 Type II
ISO/IEC 27001:2022

These certifications belong to our infrastructure provider. They cover the platform Alano runs on — not Alano's own application-level controls. We think that distinction matters enough to state it rather than let the badges imply otherwise.

Review them at the Supabase Trust Center

What Alano adds on top

Encryption in transit and at rest: Every connection to Alano uses TLS. Data on disk is encrypted by our infrastructure provider. Your contacts, notes and deals are not sent or stored as plain text.
Isolation enforced by the database: Row-Level Security is switched on across the application schema, with policies on every table that holds your records. Your workspace boundary is a rule PostgreSQL applies to every query, not a filter our code remembers to add.
Who sees what, down to the field: Access is set by role, by group, and per individual field. A group can be allowed to see a field without being able to change it, and restricted fields never leave the server in the first place.
An audit trail you can read: Database triggers record who changed what and when, with the value before and after. Entries can be added but not edited or deleted from the application, and you only see entries for records you already have access to.
Limits on the way in: Public API endpoints are rate limited per organization, with IP reputation tracking, block windows, and an optional allowlist for the addresses you expect traffic from.
Backups and recovery: Automated backups and point-in-time recovery run on the managed platform, covering the database and your uploaded files alike, so accidental loss is recoverable rather than final.

How the isolation actually works

If something goes down

Every Alano product — the CRM, Marketing, the AI assistant and Omucloud — is held to one set of continuity standards, inherited from group-level governance and applied to our own infrastructure.

Services are tiered by what their loss actually costs you, and Tier 0 — your access to your own data — is restored first and degraded last.
We target restoration in under four hours, with fifteen minutes or less of data loss. Those are design targets: we have not yet run a full failover exercise, and we say so rather than implying a tested capability.
Alano runs in a single cloud region in Asia. A regional outage would take us down for its duration — cross-region resilience is available through a dedicated deployment, not on the shared cloud.
Incidents are graded on a four-level severity scale. If one affects your data or your access to it, we tell you directly, and personal data breaches are reported to the supervisory authority within 72 hours.

The resilience page also carries an explicit list of what we have not built — no tested DR, no restore drill cadence, no public status page, no enforced MFA, no SOC 2. You will get asked about those in any serious review, so you may as well hear it from us first.

Recovery targets, incidents and known gaps

AI and your data

We do not use your CRM data to train AI models — not ours, and not third-party models — without your explicit opt-in consent.

Alano's AI features in the CRM are built on OpenAI. When you enrich a customer, generate a briefing or ask the assistant a question, the relevant content is sent to OpenAI purely to produce your response. Our consumer applications use a wider set of model providers, each named in the privacy policy for that product.
OpenAI processes it under their own data-processing terms, and we do not authorise them to train on your inputs.
We may use aggregated, anonymised usage data — which cannot identify you or your customers — to improve how the product performs.
AI output is there to assist judgment, not replace it. Verify anything that matters before acting on it.

Your data stays yours

At any point you can:

Export your contacts and CRM data
Delete your workspace or your account
Ask what personal data we hold about you, and have it corrected
Ask us to delete your personal data

We do not sell your data. To exercise any of these, email hello@alano.ai — we respond within 30 days.

Who is responsible for what, under GDPR

Where Alano can run

Most customers use the shared cloud, and nothing here needs a decision from you. If your organisation cannot put customer data on a shared platform, Alano can also be delivered as a dedicated project or built to run entirely inside your own network.

On-premise is a scoped engagement rather than a download — the database schema, the access rules and the audit engine carry over unchanged, while sign-in, email and AI features change to suit an isolated environment.

Compare the three deployment options

Report a vulnerability

If you believe you have found a security vulnerability in Alano, email hello@alano.ai with enough detail to reproduce it. We aim to acknowledge within two business days and will keep you updated while we investigate.

In scope: alano.ai, crm.alano.ai, auth.alano.ai, omucloud.co, the Alano Marketing application, and the Alano CRM Chrome extension. Please do not run automated scanning that degrades service for other customers, do not access or modify data belonging to anyone else, and give us a reasonable chance to fix an issue before disclosing it. Report in good faith and we will not pursue action against you.

security.txt

Alano.ai