Security
How we protect your data.
KnowWhyy reads some of your team's most sensitive context, so it's built to read as little as possible and keep it apart from everyone else's.
You choose what we read
Integrations use read-only, least-privilege permissions. Admins pick every repository, channel and page that gets indexed, and disconnecting an integration revokes its access.
Slack direct messages and group DMs are never accessed. GitHub source code files are never downloaded or indexed: KnowWhyy reads commits, pull requests, reviews and issues.
Isolation and access control
Every record carries its organization, and PostgreSQL row-level security enforces tenant boundaries in the database itself, not just in application code.
Workspace membership doesn't unlock everything. Private repositories, channels and pages stay restricted to owners and admins until an admin grants access, and answers only use sources the person asking is allowed to see.
Credentials and transport
Integration tokens are encrypted with AES-256-GCM using keys kept outside the database, and they are never sent to the browser. All traffic is served over HTTPS with HSTS.
Payments are handled by Paddle, our merchant of record; card details never reach KnowWhyy's servers.
Accountability
Connections, role changes and access grants are recorded in an audit log available to workspace owners and admins.
Every claim in an answer cites its source, and citations that don't map to real indexed evidence are removed before you see them.
Reporting a vulnerability
Email hello@knowwhyy.com with "Security" in the subject. Include the affected URL or feature, steps to reproduce and the impact you expect. Please give us reasonable time to fix an issue before sharing it publicly, and don't access data that isn't yours.