What Security Means in a Content Tool

Wednesday afternoon, a client's lawyer sends a security questionnaire. Question four: who can read what we give you? Your tool's website says "bank-level security," and you can't paste that into the box. (The questionnaire is made up. You've probably seen the phrase.)

Content tool security comes down to a short list: who can get in, who can see another agency's work, where client writing goes, who reads it, and how it gets deleted. A claim about any of those is worth more when you can check it, so we sort them three ways. Some you can try yourself. Some you can only read, on a page with a company's name on it. And some are a promise, which is fine as long as everyone knows that's what it is.

Below, we run GoMimic's own claims through that sort, because it's the tool we can answer for. Use the same three piles on any vendor, including us.

Claims You Can Try Yourself

These are the best kind, since you need nobody's word for them. Set up a test client with made-up work and try each one.

One more worth trying, on a free trial. Make two logins under separate accounts, add a post in one, and try opening its address from the other. You shouldn't see the post. It's a modest test of isolation between agencies, and more than most buyers ever run.

Claims You Can Only Read

You can't test from outside what a company does with what it receives. What you can do is demand a named company, a page you can open, and words that match the claim. A vendor who says "our AI partners" hasn't given you that.

• Where the writing goes. To create a piece, the source, the client's voice and facts, and what you asked for go to Anthropic's commercial API. Its commercial terms say it "may not train models on Customer Content from Services" (checked November 5, 2026).
• Recordings. Deepgram turns them into text under its own terms, and each request asks it to keep them out of its improvement program. Its own page says data from opted-out requests is kept only as long as needed to process the request (checked November 5, 2026).
• How long others keep it. Deleting something from GoMimic deletes it from GoMimic. Anthropic says it deletes API inputs and outputs within 30 days, with exceptions it lists (checked November 5, 2026). Our database backups keep a copy for a limited time, and our security page has the period. Anything sent to Google Drive or Slack stays where it was sent.
• Encryption. TLS 1.3 on the way, and 1.2 at the oldest. At rest, AES-256, which is our database host's own claim: Supabase says customer data is encrypted at rest with AES-256 (checked November 5, 2026).
• Who else is involved. The Data Processing Agreement lists every sub-processor, and says how much notice you get before one is added or replaced.

Claims That Are a Promise

Some things come down to how a company behaves. That's normal. The problem is a promise dressed up as a technical fact.

Ours is this: we don't read drafts, voice records, or approvals as part of running GoMimic. That's how we work, so we call it a promise. People here do read two things: a free-tool submission, such as a Taste Test, to check it before it goes back, and anything you write to us yourself.

The word "verified" needs the same care. Our isolation page says what it means there: row rules in the database keep each account's rows to that account, and we test them with two people on a real database. Those are our own tests. They don't mean an outside firm has audited us. The same page says where the rules stop, since nightly jobs and review links run with no one signed in, and each of those paths checks whose work it is first.

Questions to Put to Any Vendor

A security page should get more specific the longer you read it. These questions tend to show whether it does. Send them to us too.

1. Which companies receive my client's writing, and where are their terms?
2. Under which plan or agreement do you use each one?
3. Who on your staff reads client work, and when?
4. If I delete a client, what stays, where, and for how long?
5. Can I export a client myself, without emailing anyone?
6. Who sees whose work inside my own account?
7. "Verified" by whom? May I see the report, and what period does it cover?
8. How will I hear about a new sub-processor, or a change in terms?
9. What can't you promise?

The last question does the most work, and an answer of "nothing" tells you plenty. When a vendor says even its own servers can't read your client's writing, ask how the writing reaches the service that creates the draft. We don't claim zero-knowledge encryption ourselves: to create a piece, our server has to pass the text and the client's rules on over a secure connection.

When a vendor mentions an audit, ask to see it. SOC reports are work done by CPAs on a service organization's controls (checked November 5, 2026), so there should be a document. OpenAI, for one, says on its enterprise page that ChatGPT Enterprise, Edu, and Healthcare have completed a SOC 2 Type 2 audit, and points to its Trust Portal (checked November 5, 2026). That's the shape a good claim takes: what was audited, and where to look.

What Belongs in the Client Contract

Your client's contract is with you, so it's your promise that they'll hold you to. Write it to match what you've actually checked, and nothing past that.

• Access. Each person has their own login, and two-step sign-in is required. You can require it across the team, so this is one you can keep.
• Named services. List who receives the client's work, and say how you'll tell them about changes. Our page on using AI under a client NDA has sample wording.
• Incidents. Say how and how quickly you'll tell the client if something goes wrong, in a time your team can really meet.
• The end. Say what you'll delete and when, and that copies held by outside services follow those services' published terms.

Stay away from "never" and "impossible" in anything you sign, since your vendors' pages are unlikely to back you up on those. The same goes for your own website.

Where GoMimic Fits

Create client content. Get it approved. Deliver it.

Client work moves through a lot of hands: your writers, your approvers, the client's team, and the people they forward things to. That's why many of the controls above are set per client, and why the security page is written so you can send it to a client's lawyer as it stands. It covers what happens to the writing, who reads it, how it's deleted, how it's encrypted, and what we can't promise.

Terms and Privacy in Plain English gives you the short version of the agreement. The Terms of Service and Privacy Policy are the real thing, and where they differ, they win.

Questions People Ask