Security & Data
Your data stays yours, and access stays tight.
How we access your systems, protect customer data, govern AI agents, and hand everything back when an engagement ends.
Security practices
Ownership
All platforms, accounts, data, dashboards, creative and code remain in your name. We never move your customer data into accounts you do not control.
Least-privilege access
Each team member and agent gets only the permissions their role needs, using named staff accounts, never shared logins. Access is reviewed quarterly, and our goal is to remove it within one business day when someone rolls off.
Authentication
Multi-factor authentication required on every system we access. Credentials are stored in an enterprise password manager, never in documents or chat.
Customer data
Personal data is processed only to deliver the services, inside your systems, in line with your privacy policy and applicable laws such as CCPA/CPRA. We do not sell or share it.
Payment data
We never handle full card numbers. Payments stay within your PCI-compliant platforms and processors.
AI governance
Agents act within written scopes and approval rules. Every action is logged. Customer data is not used to train third-party models, and we use providers that support this approach.
How we operate.
- Confidentiality agreements with every team member
- Security and privacy training at onboarding and annually
- Documented incident response with client notification
- Data processing agreement available on request
- Vendor review for every tool we introduce
Offboarding checklist
- Final handover of runbooks, dashboards and data models
- Transfer of any assets we created in your name
- Removal of all Go Virtual user accounts and API keys
- Written confirmation of access removal
- Deletion of working copies of your data from our systems
Have a security questionnaire?
Send it with your diagnostic request and we aim to complete it before access is granted.