What it does, and who decides
In the Alpha, HeyCMO reads your failed Stripe invoices and drafts service emails. A person approves every message before it is sent.
| Does on its own | Asks you first |
|---|---|
|
|
When you approve, HeyCMO sends exactly what you saw. If anything in it changes after you approve, it does not go out, and it asks you again.
- What changes
- One email to finance@brightkite.example, sent as soon as you approve.
- How to undo
- An email can’t be unsent. If Brightkite pays, the next reminder is cancelled on its own.
- Locked
- If the recipient, the invoice or the amount changes after you approve, it asks you again.
Checks passed: your domain is set up to send, within today’s limit, the invoice is still unpaid, not on the do-not-contact list.
Approve and sendEditDeclineEach company starts in practice mode (dry-run): approving runs every check and records your decision, but nothing reaches anyone. HeyCMO’s review team approves going live once, after your sending domain is verified. Before then, we agree and write down with you who approves, which invoices are eligible, who already emails these customers, who is already suppressed, the daily send limits and who can stop it.
Six checks before an email goes out
Every email passes these checks, in this order. The first one that fails stops it, and the reason is written to your history.
- Pause switches. If Pause everything is on, or the pause for email is on, nothing goes. A switch HeyCMO can’t read counts as on.
- Do-not-contact list. Anyone who unsubscribed, bounced or complained is never drafted to again.
- Legal checks. Each email needs proof it may be sent: a verified sending domain and a real failed invoice behind it. These run even after you approve. What each email needs.
- Limits. Each company gets a daily send limit before it goes live. HeyCMO sets the highest each limit can be; you can set yours lower, never higher. At the limit, nothing more is sent that day.
- Your approval. A signed-in person at your company approves every email. Nothing sends without it.
- Stripe, once more. Just before the send, HeyCMO reads the invoice again. If it has been paid, voided or written off, or its subscription paused or cancelled, the send is refused.
Pause everything
One switch stops your workspace’s sends and job runs.
- EmailSends through ResendOn
- Who can
- Anyone on your team, from the switch at the top of every page in the web app or through the API. An API key with the start-work permission can turn it on too. Turning it off needs an admin signed in to the web app: an API key or an assistant can’t, whatever its permissions.
- How fast
- HeyCMO checks the switch before every action and again just before anything goes out, so the very next send or change is refused.
- What freezes
- Jobs stop running. Approving is refused, and each item stays waiting in your Inbox. Changes already made stay as they are.
- How to resume
- An admin signed in to the web app turns it off, and the items that waited can be approved again. Each time it is turned on or off is recorded in your history, with who did it.
You can also pause the email channel on its own. Turning a channel back on needs a signed-in admin too.
Agents and keys
HeyCMO also has an API and an MCP server (the standard way AI assistants connect to apps), so an API key or an AI assistant can read and start work. Approving is a signed-in person’s decision: your agents do the work and can decline it, and only a person signed in to HeyCMO approves.
| Who | What it can do | Can it approve? |
|---|---|---|
| AI assistants | Read your Inbox and history. Start work, where every step waits for you. Decline a draft with a reason. Pausing everything from an assistant is planned; it can never turn pausing off. It never gets permission to change settings. | No. Asked to approve, it gets a link for a signed-in person to decide.On today |
| API keys | What you give the key: read, start work, change settings, or approve. A key that can start work can also pause everything. | No, even with the approve permission. The API answers with a link for a signed-in person to decide. Declining stays open.On today |
| A signed-in person, on the web or the phone | Everything their role allows. Admins also change settings, limits and keys. | Yes. |
Each key is shown once. HeyCMO stores only a fingerprint of it (a SHA-256 hash). A key can be set to expire, and a revoked key stops working on its next request. Every key is listed with its permissions, expiry and last use.
What HeyCMO can read
HeyCMO asks for read-only access first, and for more only where a job needs it. You connect accounts in the web app. An AI assistant can list your connections, but it can’t connect one and never sees a credential.
| Service | What HeyCMO asks for | What it’s for |
|---|---|---|
| Stripe | A restricted key you create. Required: read invoices, and write webhook endpoints so HeyCMO can set up its own webhook. Optional: read subscriptions, customers, payment intents and charges, and write customer portal for a one-click card update. Everything else: none. | Finding failed payments, and seeing which were paid after an email |
| Your Resend account | A sending key for your Resend account | Sending the emails you approve from your domain, and recording bounces and complaints |
Keys you store are encrypted and never shown again: no screen or API returns one.
Outside text stays data
What HeyCMO reads is treated as data, never as instructions. Pages, reviews, emails, replies and mentions can contain text written to steer an AI. HeyCMO screens outside text for it and passes that text to the model marked as data. It is never followed as an instruction.
The models behind the drafts
HeyCMO drafts with Anthropic’s Claude models through Anthropic’s API. If a call fails and Amazon Bedrock is set up, it is retried once on the same Claude models in Amazon Bedrock. To search what it knows about your business, HeyCMO uses OpenAI, when that is configured.
A model is sent what a draft needs. For a recovery email, that is the failed invoice’s amount and decline reason, and your customer’s name and email address. HeyCMO does not remove names or email addresses before a model call. It keeps the drafts it shows you and the writing rules it learns from your team’s edits, not the prompts behind them.
“Anthropic may not train models on Customer Content from Services.”
From Anthropic’s Commercial Terms of Service. Its privacy center says API inputs and outputs are deleted from its systems within 30 days, unless a longer period is needed to enforce its usage policy or required by law.
The Amazon Bedrock FAQ says inputs and outputs are not used to train AWS or third-party models and are not shared with model providers. OpenAI’s API data guide says data sent to its API has not been used to train its models since 1 March 2023 unless a customer opts in.
We are confirming each provider’s terms against the agreements in force for HeyCMO’s accounts. Until then, the published terms are what we can point to.
Encryption and hosting
The keys you store with HeyCMO (your Stripe and Resend keys) are encrypted before they are stored. Each one has its own random key (AES-256-GCM). Each newly stored key is also bound to your workspace and the secret’s name, so a value copied to another workspace does not decrypt.
AWS KMS: on since 28 October 2026Each of those keys is wrapped with an AWS KMS key that only HeyCMO’s API can use, and only for a named workspace and secret. Every key stored before 28 October 2026 was re-wrapped that day, and the API now refuses to start without the KMS key.
Your workspace’s data is stored in a private PostgreSQL database on Amazon RDS in the AWS US East (N. Virginia) region, which can’t be reached from the internet. The web app and the API are served over HTTPS. Every database query is scoped to one workspace, and a test checks that on every change.
History you can check for tampering
HeyCMO records what it did and why: each check’s decision, each approval, send and refusal, and changes to settings, keys and switches. The database refuses to change or delete an entry, and each entry carries a fingerprint (a hash) of the one before it, so a changed or missing entry breaks the chain.
You can check your history and export it at any time through the API: GET /v1/audit/verify checks the chain, and GET /v1/audit/export exports it.
There is one exception to “refuses to delete”: HeyCMO staff can remove a whole workspace’s history through a separate database login, and that removal is itself recorded.
Outside copy: verification pendingThe hash chain and database history checks are available. The separate signed copy in Amazon S3 is still being qualified: coverage of customer history has not been verified, so we do not yet promise protection against a database administrator rewriting the chain. The Alpha storage is configured to keep each copy locked in governance mode for 1 day. HeyCMO’s API cannot delete or shorten that lock, but an administrator of HeyCMO’s AWS account could.
Legal checks on every email
Each email must carry proof that it may be sent. If the proof is missing, the email doesn’t go. These checks run even after you approve, and no one can waive them.
- Failed-payment reminders
- A verified sending domain, and a real failed invoice behind the email. The draft must keep the payment link and the amount, and it may not invent a deadline or a discount.
The do-not-contact list is checked before every send: anyone who unsubscribed, bounced or complained is never drafted to again. Marketing email is not part of the Alpha.
Export and deletion
- Export
- An admin can export the workspace’s records as JSON at any time, from Settings or the API, up to 10,000 rows of each table per export. An export never holds a stored key or an API key.
- Deleting your workspace
- Every request to it is refused at once, Pause everything is turned on, every API key is revoked and every key you stored is deleted. Then the rest of its data is deleted or cleared, table by table, and drafted emails are replaced with a redaction marker. If a step fails, a nightly job finishes it.
- What stays
- Your history, run and usage records and billing records are kept as the record of what HeyCMO did and billed. They hold ids and outcomes rather than customer data, but text a person typed into them, such as a reason for pausing, is kept as typed. A record of an edit made before 24 October 2026 also keeps the draft before and after.
- Erasing one person
- An admin can erase one of your customers by email address. Their address is removed from drafted and sent messages and the rest of your workspace’s data. A one-way hash of it stays on the do-not-contact list, so they are never emailed again, and tokens that hold no address keep their choices. Your history is not changed, and a creative image stays as it was made.
- How long data is kept
- After 90 days, the recipient and message of decided emails are removed. After 24 months, the content of decided actions is replaced, and usage and run records are deleted.
Subprocessors
Always: Amazon Web Services (hosting, the database, storage and logs, in the US East region) and Anthropic (drafting). Before your first live send: WorkOS (sign-in for your approvers).
When a listening or competitor job runs: the GDELT Project (news search) and Microsoft’s ad library, which receive only your brand’s and competitors’ names.
When we configure them: OpenAI (search over what HeyCMO knows), Nango (it holds the sign-ins of the Google and other accounts you connect), context.dev (reading your website and competitors’ changes), Resend (approval notices to the people you choose), MillionVerifier (it checks the recipient of a live marketing email, never a payment reminder), GlockApps (inbox placement tests you approve), Inngest (job scheduling), and the optional AI, research and listening services. We tell customers before we add one.
Your own accounts (Stripe, your email provider, Google and the other tools you connect) process data under your agreement with them. The full list, with what each service receives and where, is part of our Data Processing Addendum. Ask for it at security@heycmo.ai.
What we do not have yet
- Nothing beyond failed-payment emails. WordPress publishing and the wider marketing work are not available.
- No SOC 2 report and no ISO 27001 certification.
- No independent penetration test.
- No single sign-on (SAML) or SCIM. Your approvers sign in through WorkOS, set up for your company before its first live send.
- No EU hosting: HeyCMO’s own systems run in one AWS region in the US.
- No written incident response plan beyond the notification target below. Our recovery targets for the Alpha are modest: service back within an hour, and at most a day of data lost (daily backups, kept for 7 days).
- No written policy for HeyCMO staff access to production.
Report a vulnerability
Email security@heycmo.ai with what you found, where, and the steps to reproduce it. In scope: heycmo.ai, pricing.heycmo.ai, the web app at agent.heycmo.ai, and the API and MCP server at agent-api.heycmo.ai.
Please test only with a workspace and data of your own. If you reach anyone else’s data, stop and tell us, and don’t keep, change or share it. Don’t run denial-of-service tests, send spam, or try social engineering or physical access. Give us reasonable time to fix the problem before you publish it.
We will confirm we received your report, tell you what we found and when it is fixed, and credit you if you want to be named. We don’t run a paid bug bounty.
If a personal data breach affects your data, we tell you without undue delay, and aim to within 72 hours of becoming aware of it.
Questions
Can HeyCMO send an email without my OK?
No. Every email waits for a signed-in person at your company to approve that exact message. There is no setting that sends without a click, and pause switches, the do-not-contact list, legal checks and limits still apply.
Can my AI assistant approve things for me?
No. Claude, ChatGPT, Cursor and other assistants connected to HeyCMO can read, start work and decline a draft. Asked to approve, they get a link for you to open and decide yourself. An API key gets the same link, even with the approve permission.
What happens if HeyCMO gets something wrong?
You see every draft before it goes out, with what changes, why, and how to undo it. A sent email cannot be taken back, so read it carefully.
Which AI models see my data, and do they train on it?
HeyCMO drafts with Anthropic’s Claude models, through Anthropic’s API or, as a fallback, Amazon Bedrock. Anthropic’s Commercial Terms of Service say it may not train models on customer content from its services. HeyCMO does not remove names or email addresses before a model call, and it keeps drafts and the rules it learns from your edits, not prompts.
Do you have a SOC 2 report?
Not yet. HeyCMO has no SOC 2 report, no ISO 27001 certification and no independent penetration test. This page lists what protects your data today, what is built but not switched on, and what we do not have, and it changes when any of that changes. Ask security@heycmo.ai about anything not covered here.
Where is my data stored?
In a private PostgreSQL database on Amazon RDS in the AWS US East (N. Virginia) region, which can’t be reached from the internet. There is no EU hosting option yet. Keys you store are encrypted before they are stored.
How do I delete my data?
An admin can delete the workspace in Settings, through the API, or by asking us. Every request to it is refused at once, every key is revoked and every stored key deleted, then the rest is deleted table by table. Your history and billing records are kept as the record of what HeyCMO did and billed.