Security

Your payment keys

• Sumly asks for a key that can only read wherever the provider offers one: a restricted Stripe key, a Paddle key with read scopes, a RevenueCat key, the App Store's and Google Play's report access. It never writes to your payment accounts, and it cannot move money.
• Keys, tokens and webhook addresses are encrypted in the database with AES-256 and used only on the server. None is ever sent back to a browser or the app.
• Disconnect a provider, and its key and everything read with it are deleted.

Where it runs

• The server and its databases are at Hetzner in Germany.
• Cloudflare sits in front of the site: DNS, TLS and the network. Every page is served over HTTPS only, and browsers are told to keep to HTTPS (HSTS).
• The server is backed up every night to a separate machine. Each backup is kept up to 30 days, then replaced.

Signing in

• There are no passwords to leak. You sign in with Google, with a six-digit code sent by e-mail (only its hash is kept, and it expires), or in the app also with Sign in with Apple.
• Each phone or tablet gets a key of its own. You can see your phones in the app and sign any of them out.
• Delete your account and the workspaces that are yours go at once, with everything read for their projects.

Your team

Invite people with one of four roles, each to every project, to whole companies or to chosen projects. Only the owner sees the plan and billing.

• Viewer. Sees the numbers, changes nothing.
• Member. Also adds costs, notes, goals, funnels and alerts.
• Admin. Everything the owner does but the plan and billing, on every project.
• Accountant. Only Money › Monthly reports of the companies given: download, the invoices address, mark as handled.

AI assistants over MCP

• ChatGPT, Claude and other assistants connect with OAuth 2: you sign in to Sumly and approve the assistant, which never sees a password or a payment key. Its access token lasts 30 days and is renewed while you keep it connected.
• An assistant sees what you can see, no more. Disconnect it under Assistants and its tokens stop working.
• Ask, the chat on the site, sends your question and the numbers it needs to OpenAI's API to write the answer. OpenAI does not train on API data.

Your visitors

• No IP address is stored. Country and city come from the request; the address itself is dropped.
• One exception, kept short: a tap on an App Store button stores a hash of the address, with a salt that changes every day, for one hour, so an iPhone install from the same network can be matched to it. Then it is deleted.
• In the EU, the EEA, the UK and Switzerland the script sets no cookie until your site says the visitor agreed, and a browser that sends Global Privacy Control is counted without a cookie anywhere.
• Raw visits are deleted after 25 months. Server logs, which do hold addresses, are kept up to 30 days.

Paying us

Plans are paid through Stripe. Card numbers go to Stripe and never reach Sumly's server.

Contracts and a problem you found

The sub-processors page lists everyone who processes data for us, and the data processing agreement covers the personal data in your workspace. Is something down? The status page shows it.

Found a weakness? Please tell us before anyone else, through the support page or at [email protected]. We answer quickly and will say when it is fixed.