Overview
Heyou is built to be trustworthy with data that matters — your customers, your team's professional identities, and the conversations that make up your real relationships. This article summarises the design and the controls that back that trust: what Heyou will and will not do, where your data lives, how it is protected, who can access it, and where to find the deeper technical detail.
Everything below is customer-facing. For the full documents your security or legal team will want to read, we publish them at heyou.io/trust/overview, heyou.io/security, heyou.io/dpa, and heyou.io/privacy-policy.
Scope
This article covers:
Human-led engagement by design
Heyou never sends messages, connection requests, comments, likes, follows, posts, or profile changes on your behalf without your explicit action. AI suggests; you review and decide. Every outreach is drafted, shown to you, and only leaves when you send it. This is not a policy setting that could change with the next release — it is how the platform is built.
What Heyou reads — and what it does not
Heyou reads professional relationship context to inform its recommendations. Two tiers govern what it reads and who can see it:
Organizational data is context your organization has authorised for use in your Heyou workspace — CRM records, work email and calendar metadata (where enabled), directory information, professional relationship context your team contributes. It is visible inside your organization according to the roles your admins set.
Personal data is context an individual user chooses to connect from personal or user-controlled sources — LinkedIn under that user's own session, WhatsApp on that user's own device, and similar. Personal-tier data is private by default. It is not visible to your organization's admins or teammates unless the individual user affirmatively chooses to share specific data.
For private messaging sources like WhatsApp, Heyou reads metadata only — who is talking to whom, when, how often — and never message content.
Heyou does not collect passwords, third-party platform credentials, or reusable session tokens. It does not bypass login, privacy settings, or restrictions on the platforms it reads. And it does not use your data to train foundation AI models.
How your data is protected
Tenant isolation. Your data is scoped to your organization and never mixes with any other customer's. The tenant boundary is enforced at every query, at the source.
Encryption at rest. Customer data stores and backups are encrypted using managed cloud encryption.
Encryption in transit. All network traffic uses TLS. Sensitive personal-tier payloads (like WhatsApp metadata) are additionally sealed end-to-end from the browser to the service.
PII minimization. Where direct identifiers are not required for third-party AI processing, they are masked with placeholders before the AI call and re-associated inside Heyou.
Data residency. Customers can be configured for region-aligned deployment. EU tenants are stored in Google Cloud's europe-north1 region in Finland unless otherwise agreed.
Access, consent, and control
Access to Heyou is controlled through your organization's identity provider, with single sign-on support and enforced multi-factor authentication for internal administrators. Role-based access controls govern what each user can see inside the product, including the Team Manager role for team-wide visibility scoped strictly within your organization.
Every source Heyou reads is opt-in — either at the organization level by your admin, or per user by the individual. Removing consent stops the source immediately. Data already ingested is retained under the terms of your Heyou agreement and can be removed on request; the specifics are set out in the Data Retention Schedule and the Data Processing Addendum.
Certifications and independent review
ISO/IEC 27001:2022 — Certified. Certificates and attestations are downloadable from the Trust Overview.
SOC 2 Type II — Audit engagement signed; observation period in flight. The final report will be available under MNDA on completion.
Third-party penetration testing — Performed as part of the security program, with remediation tracking.
Coordinated vulnerability disclosure — Reports welcomed at dpo@heyou.io and handled under our disclosure process.
Recent enhancements
The most recent additions to this module. New entries are added by Heyou's release process.
August 2026 — A new Team Manager role was added, purpose-built to give sales managers a team-wide view without granting them platform-wide admin. Same-tenant access is enforced with a fail-closed check so cross-organization visibility remains impossible by design.
July 2026 — The WhatsApp integration completed its end-to-end data-protection layer: sealed transport from your browser to the Heyou service and authenticated at-rest encryption for contact identifiers. Failure telemetry was restructured so operational alerts carry only the fields needed to diagnose an issue, with personal data excluded.
June 2026 — Independent third-party penetration testing was completed, with all findings tracked to resolution. Standard web security headers (CSP, HSTS, and related) were tightened across every Heyou surface.
For a deeper technical view — including certifications, incident response commitments, subprocessor listing, and the browser extension's enterprise posture — see the public Trust Overview and Security Overview. For questions on any of this, reply to any Heyou email, open the in-product chat, or write to dpo@heyou.io.