Your customer list is your business. We treat it that way.

What this means for you

An email attachment is the worst place your customer list can live. It sits in your sent folder and in ours forever, and anybody who gets that thread forwarded gets your customers with it.

What we actually do

• We create a folder named for your business and share it with your email address, not with a link that anyone who has it can open.
• You put your export in it. We pull it down and work from our own copy.
• If you email us the file anyway, we move it into the folder, delete the email, empty our trash, and ask you to delete it out of your sent items.
• Nobody else gets added to that folder. If we ever needed to add somebody, we would ask you first.

Example

An owner exports contacts out of their booking software on a Thursday afternoon. The file goes straight into a folder only two people can open. It never touches an inbox, so there is no copy sitting in a mail app on a phone six months from now.

What this means for you

Most companies answer this by saying it is in the cloud and encrypted, then stop there, which tells you nothing about who can reach it. We can tell you the machine.

What we actually do

• Your file goes into one folder on one Mac, and that Mac has full disk encryption turned on.
• That folder is deliberately left out of our backups, so it cannot copy itself onto a phone or into a cloud drive without somebody choosing to do it.
• Nobody outside kancir AI has that laptop or that folder.
• When you ask us to delete your file, we delete the file and the working database built from it, and we tell you when it is done.

What this means for you

You are probably picturing software reading your customer file and inventing things to say. That is not what happens here. You read the message once and approve it, and everyone on the list gets that message with their own first name in it.

What we actually do

• Messages to your list are filled-in templates. You see the template before anything sends.
• When we read your export, any column that looks medical gets dropped on the way in, and the loader tells us it dropped it. It is not ignored. It is not there.
• The same check runs again on every message going out, so a medical word cannot escape by accident.
• Our code refuses to send a first message carrying a price or a date. It refuses one that names a past service too, no matter who wrote it.

Example

If your export has a column of treatment notes in it, our loader drops that column before the file is even open, and the report we hand you says which columns it refused. Nobody at kancir AI reads them.

What this means for you

A login into your booking system is a bigger risk than the file, because a login is live and a file is not. The safest version of this is not holding one at all, and that is where we start.

What we actually do

• The audit needs no access to anything of yours. You send a file and that is the whole handoff.
• If ongoing work needs access, we ask you to make us our own user instead of handing over yours, with only the permissions the job needs.
• That login lives in an encrypted password manager, never in a text message and never in a note app.
• You can turn it off from inside your own system whenever you want, and you do not have to tell us first.
• When the work ends, you cut it and we confirm on our side that it is dead.

Example

An owner offers the login they use themselves, because it is the one they know. We ask instead for a separate user named for us, with contacts and reporting turned on and billing turned off. If that user ever does something strange, it is obvious in your own log who it was.

What this means for you

Companies leak this way constantly. Somebody pastes a password into a working file, that file gets published without anyone thinking about it, and a bot finds it within the hour.

What we actually do

• Passwords and access keys live in one local settings file that is blocked from ever being published or shared.
• Your customer folder is blocked the same way, so it cannot get published by accident.
• Our logs scrub anything that looks like a password before it ever gets written down.
• The parts of the system that actually send a message never record the message or the real phone number, only that a message moved.

Example

If a run hits an error, the log line says something like: message 41 failed on the text rail. It does not say who it was going to, and it does not say what it said.

What this means for you

Phone numbers get recycled. If a message goes out asking whoever owns that number now about rebooking, that is your name on it, not ours and not the phone company's.

What we actually do

• The first message says who you are and nothing else. Our code checks it before it moves and refuses anything more.
• Every text carries the word STOP. Every email carries a way to unsubscribe.
• A stop reply, or anything that reads like a wrong number, ends that contact permanently. Not paused, not for 30 days. Permanently.
• A person approves each batch on a phone before it moves. There is no way to skip that step.
• We have not sent one message to a real customer yet. The first one goes out with you watching.

Example

The first text reads: Hi [first name], this is [your business]. We worked together a while back. Want me to send you details? Reply STOP to stop. That is the entire message. There is no price in it and no mention of what they came in for.

What this means for you

There is no live link between us and your business to worry about. Nothing of ours is sitting inside your booking system watching. There is a file, and there is a report.

What we actually do

• The audit is a one-way handoff. A file comes to us and a report goes back.
• We are not installed inside anything of yours, so there is nothing of ours for you to remove later.
• If ongoing work ever needs a live connection, that is a separate conversation with you before anybody sets anything up.
• When we do set one up, we will use a private company network with a fixed address, so your system always sees the same known login location instead of a different coffee shop every week.

What this means for you

This is the leak nobody plans for. Somebody tells a good story at a networking lunch and now three strangers know what your business did last quarter.

What we actually do

• Your numbers do not leave the two people who run this.
• We keep a second copy of every report with every name and number stripped out, so when we need to show our work there is already a version that identifies nobody.
• Using you as an example takes a written yes from you. A verbal yes at the end of a good call does not count.
• Saying a client of ours still counts as talking about you, so we do not do that either.

Example

Every report we write gets built twice. One version has the real people in it and goes to one person, which is you. The other has none of them, and that is the only one that exists outside your folder.