Workspace isolation
Every charity's data lives in its own workspace. Isolation is enforced at the database layer with PostgreSQL row-level security — including forced row-level security on sensitive tables — so one workspace's queries cannot read another workspace's rows, in addition to the application-level checks.
Encryption
All traffic between your browser and Membrs is encrypted with TLS (HTTPS). At rest, sensitive stored fields — such as connected-account credentials and messaging tokens — are encrypted with AES-256-GCM. Account passwords are never stored; we keep only Argon2id hashes.
Backups & recovery
The production database is backed up daily, with a copy replicated to a separate server. We run an automated restore test every week — each backup is restored into a scratch database to prove it actually restores, not just that the file exists.
Your data, your controls (UK GDPR)
We work to align with UK GDPR. You can export your full workspace data and delete your account yourself, at any time, from Settings → My Account — export and deletion are both live, self-serve features, not an email-us promise. Details of what we store, why, and for how long are in the privacy policy.
Human review of AI conversations
To fix problems and improve Isla's answers, a small number of Membrs staff can review conversations — particularly ones you flag with a thumbs-down. Review access is restricted and logged, and your conversations are not used to train third-party AI models. The full disclosure is in the privacy policy.
Reporting a vulnerability
If you believe you've found a security issue in Membrs, please email hello@membrs.ai with the details. We read every report and will respond.
What we don't claim
We do not currently hold SOC 2, ISO 27001, or Cyber Essentials certification. If that changes, this page will say so. If your organisation has a due-diligence questionnaire, we'll answer it honestly — email hello@membrs.ai.