Last updated: April 20, 2026
Catch reads your team’s email, calendar, and CRM data to extract the commitments your reps make to customers and surface where execution breaks down. Catch is designed for revenue execution workflows; we ingest only the systems and content required to identify commitments and track follow-through. Because we analyze your content, we cannot end-to-end encrypt it. No AI product that analyzes customer data can. What we can do is make access to your data rare, controlled, logged, and revocable. This page explains how, in plain language, without the marketing phrases that tend to collect on security pages.
If you have a question that isn’t answered here, email security@usecatch.io.
When you connect Catch to your workflow, we ingest:
We only ingest what’s necessary to identify commitments and track their follow-through. We do not crawl content unrelated to sales execution.
From the ingested content, we extract:
The extracted structured data is what powers your dashboard and audit reports. The raw ingested content is used to produce that structured data and to provide evidence excerpts in your reports.
In transit. All communication between your browser, Catch’s servers, and our connected services uses TLS 1.2 or higher.
At rest. All data is encrypted at rest by our infrastructure providers using AES-256.
OAuth credentials. The tokens we hold to access your Gmail, CRM, and other connected services are additionally encrypted at the application layer before storage. Even with direct database access, the tokens cannot be used to access your connected accounts without a separate encryption key held only in our application environment.
Workspace isolation. Every piece of customer data is tagged with a workspace identifier, and row-level security policies at the database layer are designed to prevent cross-workspace access even if application logic fails. Every new database migration is validated in continuous integration to confirm row-level security is defined where required. No code path in our system aggregates customer data across workspaces for cross-customer analysis.
Production access control. Production systems are accessible only to the Catch team. All access requires multi-factor authentication, with hardware security keys on the highest-privilege accounts (GitHub, Vercel, Railway, Supabase, Google, domain registrar).
Environment isolation. Our preview and development environments are prevented at startup from connecting to production databases. A misconfiguration that would link a preview environment to production credentials fails the application startup rather than booting with the wrong data.
We believe in telling you what our security model cannot do, not just what it can:
By default: only you and the users you invite to your workspace see your workspace’s data through the product. Other Catch customers never see your data.
Catch team access: limited today to Eric Pereira, founder. Administrative access is used only for engineering, debugging, security response, and customer-requested operational tasks. As we hire team members with production access, we will maintain a public list at usecatch.io/security#who-can-access.
Third parties: only the subprocessors listed below, each for the specific purpose described.
Catch uses Anthropic’s Claude as our AI inference engine. We do not operate a proprietary AI model, and we do not fine-tune, train, or update any model using customer content. This is both our current architecture and our committed product principle.
Our product improves through four mechanisms, none of which involve training a model on customer data: we refine the prompts we send to Claude based on observed extraction quality; we adjust heuristics and confidence thresholds in our processing pipeline; we add product features based on aggregated usage patterns; and we improve how we construct context for Claude’s extraction calls.
All of these improvements apply equally across customers in the next release. They are not personalized to any individual customer’s data, nor do they cause one customer’s data to surface in another customer’s experience. Within your workspace, your data drives your commitments and audits. Across workspaces, nothing is shared. If we ever propose changing this architecture in a way that would affect this commitment, we would communicate it to customers in advance.
| Data type | Retention |
|---|---|
| Raw email bodies | 90 days after ingestion (target policy; currently being implemented) |
| Call transcripts | 90 days after ingestion (target policy; currently being implemented) |
| Extracted commitments and audit artifacts | For the lifetime of your workspace |
| OAuth tokens | Until you disconnect the integration |
| Application logs | 30 days |
| Security and audit logs | 2 years (operational metadata; never includes raw customer content) |
| Backups | 30 days rolling |
When you delete your workspace, customer content is purged within 30 days of the deletion request. Security and audit logs may retain limited operational metadata (workspace ID, action timestamps, administrator identity) per the retention schedule above; these logs never include raw customer content such as email bodies or transcripts.
Disconnect any integration. For supported OAuth-based connectors, disconnection from your workspace settings revokes our stored tokens and stops further data ingestion from that service. Disconnection is recorded in your workspace’s activity history.
Export your data. You can request an export of your workspace’s commitments, audit reports, and associated metadata by emailing security@usecatch.io. We deliver exports in a structured format within 14 days. Self-service export from workspace settings is on our active roadmap.
Delete your workspace. You can request workspace deletion by emailing security@usecatch.io. Deletion proceeds in two stages: a 30-day soft-delete period during which you can recover if the request was accidental, followed by a hard-delete that purges all your customer content from our production systems.
Request a data report. You can ask for a summary of everything we have about your workspace at any time by emailing security@usecatch.io. We respond within 14 days.
Our commitment: If we confirm a security incident affecting your data, we will notify you within 72 hours. The notification will describe what we know, what we’re doing about it, what data was affected, and what (if any) action is recommended on your end.
Our process:
We would rather over-notify than under-notify. If we notify you about an incident and later determine the scope was smaller than initially feared, we will tell you that as well.
Customer data is stored in the United States. Our subprocessors:
The current list is maintained on this page. Material changes are published in our changelog.
Security at Catch is a continuing discipline, not a compliance checkbox. Active work:
We do not commit to dates on this page because we would rather ship the work than commit to dates we might miss. If you have a specific need, email security@usecatch.io and we will share our current timeline privately.
General security questions: security@usecatch.io. This goes directly to the founder.
General support (fallback if security inbox is unreachable): support@usecatch.io
Responsible disclosure of vulnerabilities: security@usecatch.io with a subject line starting with “VULN:”. We commit to:
Material changes to our security posture are published at usecatch.io/security/changelog.
This page describes Catch’s current security posture and may be referenced in customer security reviews. For the most current version, always visit usecatch.io/security directly.