Security & data
Placeholder — the staff-access banner, 30-day erase (against D11) and mailboxes are confirmed by backend before launch.
What leaves Friday, when, and on whose account
Nothing leaves Friday unless you or your agent send it. Friday runs no AI model of its own. When your agent reads a candidate to score them, that text goes to your agent, on your account, under its provider’s terms — not ours. Email goes out from Friday’s shared outreach domain, attributed to you.
Tenant isolation
Each workspace is its own tenant. Queries are scoped to the workspace on every request; there is no cross-workspace search, cache or index. Staff access needs your approval and shows as a banner while it is on.
Where data lives
In India. US hosting is available on request and comes with Organizations.
DPDP and consent
Consent is a field on every candidate — yes with a date, no, or expired — and Friday checks it before any message is sent. Erasing a candidate removes them in 30 days; do-not-contact and placed-by-us records are kept as the law allows.
Agents and permissions
An agent acts as its owner: exactly their permissions, never more. Every action is recorded with both names. Revoke it in one click; past actions keep their label.
Reporting a problem
Found a problem? Email security@friday.kodiva.ai.