Security · version 0.1.0 · effective: DRAFT
Who Does What
DRAFT — requires review by qualified counsel in each jurisdiction. Not in force.
In one line
Keeping your business safe online is a shared job. This page shows clearly what qypu does, what you do, and what the platforms and our providers do.
The short version
This short version helps you understand the full text. Read the full text for the complete terms.
- qypu drafts, checks, protects your data, and publishes only what you sign. (Full text, section 1)
- You decide what is true, who can sign, and what gets published. You keep your own sign-in safe. (Section 2)
- Platforms (Meta, TikTok, LinkedIn, and YouTube) run their own services and rules. (Section 3)
- Our providers run the hosting, database, and AI models under contract with us. (Section 4)
- If something goes wrong, the table shows who acts first. (Section 5)
Full text
Read the full text (about 2 minutes)
1. What qypu does
- Builds your Brand Kit from your answers and keeps it where you can edit it.
- Drafts content within your hard facts, never-say list, and licence level.
- Runs Checks and shows you every flag.
- Publishes only posts you have signed, on channels you connected.
- Labels AI content and keeps provenance marks.
- Encrypts access tokens and deletes them when you disconnect.
- Gives AI steps only the access their task needs.
- Monitors the service and tells you about incidents that affect you.
2. What you do
- Keep your hard facts true and up to date.
- Choose your signers carefully, and remove people who leave.
- Read every post before you sign it.
- Get consent from anyone who appears in your content.
- Keep your own email and platform accounts secure, with multi-factor authentication.
- Tell your staff how qypu is used in your business.
3. What the platforms do
- Run the social networks and decide what their rules allow.
- Show AI labels to your audience.
- Control their own security, outages, and data handling, under their own privacy policies.
4. What our providers do
- Host the app (Vercel), protect the network edge (Cloudflare), store data (Supabase), sign you in (WorkOS), and run AI models (for example, Anthropic). The full list is on the Subprocessors page.
- Each is bound by contract to protect your data and use it only for qypu.
5. When something goes wrong
| Problem | Who acts first | Who helps |
|---|---|---|
| A wrong fact appears in a draft | You return it with a comment | qypu improves the Checks |
| A signed post has a mistake | You (delete or edit on the platform) | qypu can unpublish where the platform allows |
| A staff member leaves | You remove them as a signer | qypu shows you who can sign |
| A platform rejects a post | qypu tells you and retries | The platform |
| You suspect someone got into your workspace | You tell us at once | qypu revokes sessions and tokens |
| A security incident at qypu | qypu | Our providers; we tell you |
| A platform outage | The platform | qypu reschedules and tells you |
Change log
- 2026-10-10 · 0.1.0 · First version. Adapted from the "shared responsibility" idea common in cloud security, written for small businesses.
Open questions for counsel
We publish these while the page is a draft, so you can see what is not settled yet.
- Ensure this page does not shift liability in a way that conflicts with the Terms or the DPA; it is explanatory only.
Useful for: Business owners, Your staff, IT and security reviewers, Platform reviewers. To save this page as a PDF, use your browser's Print command. Back to the trust centre.