Hosting
Friday runs on Google Cloud in the United States. The app runs on Cloud Run behind Google's HTTPS load balancer, and data is stored in Cloud SQL (PostgreSQL) and Cloud Storage. The database has automated daily backups and point-in-time recovery.
Some customers run on a dedicated deployment: its own Google Cloud project, database and keys, used by that one customer.
Encryption
- All traffic uses TLS 1.2 or newer, with HSTS. Friday does not accept connections over plain HTTP.
- Data at rest is encrypted by Google Cloud's default encryption.
- Tokens for connected accounts (Google, Slack, Zoom, GitHub) are encrypted again with AES-256-GCM under a key that is separate for each deployment.
- Friday does not store the Google tokens used to sign you in.
- Invite links, MCP authorization codes and API tokens are stored only as hashes.
- The app reaches its database through Google's Cloud SQL connector with IAM authentication, and database users are service identities rather than people.
Who can reach your work
- Workspaces are invite-only. A session works only for a member of that workspace.
- Your workspace comes from your signed session, never from a request someone can edit.
- Each deployment has its own session key. Session cookies are host-only, Secure and HttpOnly, and a session lasts at most seven days.
- Admin actions need a recent passkey check: within the last eight hours to invite people, and within the last ten minutes to erase data. Every admin gets an email when someone adds a passkey.
- You can see where you are signed in, sign out other sessions, and remove apps you authorized, under Settings, then Security.
- Production secrets are granted to one service at a time, access to them is logged, and unexpected access raises an alert.
People on the Friday team look at workspace content only when you ask us for support, to investigate a security issue, or when the law requires it.
What Friday may change
Sending email, posting messages, inviting calendar guests and widening who can see a file need a person's approval: on a preview card, in your own words in that chat, or through a pre-approval you set for that chat. Edits to existing documents, sheets and slides are previewed before they apply. Connector access is scoped to what each feature needs: for example, Google Drive can be limited to files you pick, and Zoom is read-only.
AI models and your data
Friday does not train AI models on your content. Friday sends content only to AI model providers, and the specific service tiers, that have committed not to train on it. For chat models Friday enforces this in code: a model without that commitment cannot be registered. Email security@friday.land for the current list of providers.
Logging and audit
Operational logs are designed to record IDs and hashes, not the content of your documents or messages, and a shared sanitizer strips credentials. Friday keeps audit records of admin operations, actions it takes in Gmail, and data erasure.
Vulnerability management
- Every release passes Friday's automated tests and checks first.
- Changes fail review when they add known vulnerable dependencies above a severity threshold, and any exception is tracked with a review date.
- Dependency and container scanners report on Friday's builds.
Assessments
Friday's Google Cloud Application Security Assessment (CASA), required for Gmail and Drive access, is in progress. Friday does not have a SOC 2 report yet. Send security questionnaires to security@friday.land.
Deleting data
Workspace owners and admins can erase a person's data, or the whole workspace, under Admin, then Data erasure. Erasure waits 24 hours so it can be cancelled, revokes connected accounts, deletes the data in Friday's database and storage, and checks the deletion. Database backups and deleted files age out within seven days, and logs within 30. Some copies, such as records covered by an organization's own agreement and responses stored by some model providers, are handled separately; the erasure preview lists them. You can also email privacy@friday.land.
Report a security issue
Email security@friday.land with what you found and how to reproduce it. Please give us a chance to fix the issue before you share it publicly, and do not access other people's data while testing. We read every report and reply as quickly as we can.