Security and trust
Modou puts anything somebody outside your company could see in front of you first. On top of that, Modou connects to business tools through limited permissions, keeps customer data separated per account, and encrypts traffic and stored platform data. You stay in control of connections and deletion.
Reviewed 30 August 2026
Messages, emails and other actions somebody outside your company could see are put in front of you first. Modou never calls or emails a customer of yours on its own initiative. That is not a promise in a text but a control in the code: a risky action is queued and only happens after you have approved it. Approved and executed actions are recorded, so you can see afterwards what happened.
Accounts use Supabase authentication. Tool connections use OAuth or a customer supplied credential where required. Modou receives only the permissions accepted during connection, and a saved credential is never displayed in the browser again.
Traffic uses HTTPS. Platform data stored in Supabase is encrypted at rest. Row level security and customer identifiers keep one account from reading another account's rows.
Modou currently uses Google Gemini through Vertex AI. Relevant task context may be sent to the model to produce an answer or plan. Customer prompts and tool data are not used by Modou to train a shared model.
The production database is hosted by Supabase in the European Union. AI processing may use Google's global infrastructure, so Modou does not claim that every AI operation remains inside the European Union.
Customers can disconnect tools and delete their account. No online service can promise zero risk. If a connection expires or a provider fails, Modou pauses or reports the problem instead of claiming the action succeeded.
Send security questions or responsible disclosure reports to hi@modou.io. Include the affected page or feature and enough detail for us to reproduce the issue.
