Security.

• Your data never trains AI. Nothing you give Seam is used to train AI models, ours or anybody else’s.
• The AI never learns who you are. We never send your account email address to AI model providers, including for our support assistant. If your own documents or notes contain it, it goes with them.
• Nothing goes out without you. Seam drafts letters and consultation responses. It never sends one until somebody at your company approves it.

• No password to steal. We email you a link that opens Seam. Each link works once, even if it is pressed twice at the same moment, and runs out after an hour.
• Sessions end. A sign-in lasts 30 days. Signing out ends it on every device, not only the one in your hand.
• Your team stays yours. Colleagues with your company’s email address can join your account. Free and shared addresses, such as Gmail or Outlook, cannot open or join an account.

• Connections are locked. When you connect Google, Microsoft, Slack, Teams, HubSpot, Attio, Notion or Granola, we store the permission encrypted.
• A stolen copy would not open them. Our database holds nothing a browser could use to sign in as you or to reach your connected tools.
• We ask for as little as we can. Calendar access is read-only. On Google Drive we can only create and change our own files. Disconnect, and we delete the permission.

Stripe handles every payment on its own pages. We never see or store your card details. Each payment notice from Stripe is checked, and is applied once only.

• Encrypted connections, always. Every page and every request uses an encrypted connection. Browsers are told never to use an unencrypted one.
• Safe pages. Our pages refuse to be shown inside another site’s page, which stops a common trick for capturing clicks. Seam never asks for your camera, microphone or location.
• Secrets with one job. Each password the service uses has one job, is kept out of our code, and can be changed without disruption.
• Checked before every release. Seam is published only after a full set of automatic checks passes. They include a check for every security fix we have made, so a fix cannot be quietly undone.
• Small logs. Our error logs carry no email addresses, and error messages never show internal details to your browser.

In October 2026 we reviewed Seam against the controls that SOC 2 and ISO 27001 auditors look at. These are the two security standards larger companies most often ask their suppliers about. We fixed what we found, and each fix now has an automatic check.

We do not yet hold ISO 27001 certification or a SOC 2 report. If your customers ask you about your suppliers, write to us and we will answer their questions.

Seam is run by Futureworks Intelligence Ltd, a UK company, under UK data protection law. Cloudflare hosts the service. We publish every company that handles data for us, what each one does and where it is, in our privacy notice.

If a breach ever put you at risk, we would tell the Information Commissioner within 72 hours, and we would tell you without delay.

If you think you have found a security problem, email [email protected]. Please do not share it publicly until we have had a chance to fix it. Our contact details are also in the standard security.txt file.