Firstweek connects to some of the most sensitive parts of your company — code, docs, conversations. We think you deserve to know exactly what we do with that access, in plain language. Here it is.
Your data belongs to your company. Full stop.
We will never —
The only reason your data exists in our systems is to generate onboarding content for your workspace. That's it. We don't monetize it, we don't analyze it for trends to sell, and we don't hand it off to anyone who doesn't need it to run the product.
If you ever want it deleted, email [email protected] and we'll take care of it.
We design every feature with security as a requirement, applying the controls you'd expect from a SOC 2-aligned system as we work toward formal certification.
Every connection between your browser, our servers, and any third-party service uses TLS. Your data is never sent over an unencrypted channel.
Our database is encrypted at rest. PII fields — new-hire emails, SSO credentials, OAuth tokens — get an additional layer of AES-256 encryption at the application level before they're written to disk.
Every database query is scoped to your workspace at the application layer. It is architecturally impossible for one company's data to be returned in another company's request.
Production system access is restricted to authorized personnel only. All administrative access is logged. Your team controls their own permissions within your workspace.
When you hit "generate," here's the exact sequence:
What we never send to AI providers: email addresses, OAuth tokens, SSO credentials, payment data, or anything beyond the content needed to write the letter.
On AI training: We will not use your data to train AI models without your explicit prior written consent. If that ever changes for your workspace — say, as part of a pilot program — we'll ask you first and put it in writing.
As Firstweek grows, we may use additional AI providers for specific features. Any new provider will appear on our Subprocessors page before they touch your data.
We use a small set of third-party services to run the product. Here's the plain-English version — the full legal list is on our Subprocessors page.
Privacy questions, data requests, security disclosures — we read everything sent to these addresses.
For the full legal version of our data practices, read our Privacy Policy, Terms of Service, and Subprocessors list.