MessyOrg Trust Center

MessyOrg builds on managed cloud platforms rather than self-managed servers, so patching and platform hardening sit with the provider.

Applications are built with authentication and row-level access rules by default, so a signed-in user can reach only the records they are entitled to.

Security is treated as part of scope, not an add-on: access rules, roles and data handling are agreed during Design and checked during Verify.

Enquiries, proposal requests and chat messages submitted on messyorg.com are stored in MessyOrg's own managed database and are readable only through server-side, owner-authenticated access.

We ask for the information needed to scope work, and nothing else. Form submissions are used to respond to you and to scope an engagement.

Client production data belongs to the client. What MessyOrg may access, and for how long, is defined per engagement.

The MessyOrg client workspace uses email and password sign-in with email confirmation, and roles are stored separately from user profiles so a user cannot grant themselves access.

Client workspace access is invite-only: an account only sees a workspace when its email has been invited by MessyOrg.

Applications we build for clients use the same pattern — explicit roles, server-side checks, and least privilege by default.

Every client record in the MessyOrg workspace is scoped to that client, and database policies enforce the scope rather than the interface.

Client engagements are separate projects with their own database, credentials and deployment. Client data is not pooled across engagements.

messyorg.com and the MessyOrg products run on managed hosting with managed Postgres, served over HTTPS.

Infrastructure choices for a client engagement are agreed during Design and documented at handoff, including what is needed to run and redeploy the application.

API keys and other secrets are stored as server-side environment secrets, never in front-end code or in the repository.

Secrets are readable only by server-side code. At handoff, credentials are transferred to the client's control or rotated.

AI features in MessyOrg products and in client applications are built deliberately: a defined task, defined context, and guardrails on what the model can act on.

The assistant on this website sends the conversation to a hosted model to answer questions and, where you offer them, to record your contact details so we can reply.

AI is used to help build and explain software. Decisions about architecture, data and access are made and reviewed by people.

MessyOrg uses third-party technology providers where necessary to design, build, host, operate, monitor, communicate, and support software. The providers involved vary by engagement.

The current provider list, with the purpose and the data involved for each, is set out under Third-party technology providers below.

Ownership of client-specific application code, MessyOrg proprietary technology and third-party technology is defined in the engagement agreement.

See Ownership & handoff below for how MessyOrg separates those categories.

Verify is a stage of every engagement, not an optional extra: what was built is tested, documented and reviewed against the agreed scope before launch.

MessyProof is our own verification technology — it examines a codebase's architecture, dependencies, configuration and changes so the state of a build is visible rather than assumed.

A verification review reports detectable configuration and implementation signals. It is not a security certification or a guarantee of production readiness.

Applications are deployed with platform-level logging so errors and failed requests can be investigated.

What is monitored, what counts as urgent, and how issues are raised is agreed at the start of a MessyCare engagement.

When client data is scheduled for deletion, MessyOrg removes or initiates removal of applicable information from active systems according to the agreed retention requirements. Residual copies may temporarily remain in encrypted or provider-managed backups until those backups expire through their normal lifecycle.

MessyOrg systems use the managed database platform's built-in backup capability rather than a separately operated backup estate.

Where MessyOrg controls or can configure the applicable backup lifecycle, residual backup data should ordinarily expire within a further 90 days.

MessyOrg does not claim the ability to independently delete information from immutable or provider-controlled backups. Retention of those copies is governed by the provider's own policies.

Backup frequency, retention and recovery expectations for a client engagement are agreed during Design and written into the plan.

Security or privacy concerns can be reported to MessyOrg for review and appropriate response.

MessyOrg follows a documented sequence when a potential security, privacy, availability or data incident is identified.

If something goes wrong on a MessyOrg-supported application, the route is direct: one company, one accountable contact, no ticket triage layer. The eight steps below set out what happens next.

Notification timing is governed by the applicable agreement or by law. MessyOrg does not publish a guaranteed notification window.

MessyOrg does not operate a 24/7 security operations centre or a dedicated security team, and makes no claim of guaranteed containment times, guaranteed recovery times, forensic capability or security certification.

MessyCare is the ongoing support arrangement that carries an application after launch: changes, integrations, monitoring follow-up and the questions that arrive once real work runs through the software.

There are two levels — MessyCare and MessyCare Priority — each with published target initial response times, set out under MessyCare support levels below.

Support availability and response targets are defined by the applicable MessyCare plan or client agreement. MessyOrg does not claim 24/7 support, guaranteed uptime, guaranteed resolution or guaranteed response times.

General business inquiries are typically answered within one business day.

Support availability and response targets are defined by the applicable MessyCare plan or client agreement.

Contractual service levels, if any, are defined in the applicable agreement. Nothing on this page creates a service-level commitment.

Unless otherwise agreed, MessyOrg ordinarily retains client project data for the duration of an engagement and for up to 90 days following completion or termination. Different retention requirements may be established in the applicable agreement.

This is a baseline. It describes how MessyOrg ordinarily handles client project data, not a promise that every copy of every record is erased on a fixed date.

Clients can request deletion of their project data at any point. Where deletion is technically and legally possible, MessyOrg carries it out or initiates it; where it is not, we say so and explain what remains and why.

Retention may run longer where: continued retention is required by the applicable agreement; records must be kept as legitimate business records; applicable law requires retention; information must temporarily remain in provider-managed backups until those backups expire.

Requesting deletion. A deletion request can be sent to MessyOrg directly, or raised through the client workspace during an engagement. We confirm what was deleted, what is scheduled for deletion, and anything that must be retained.

Organizations with specific data-processing requirements may contact MessyOrg to discuss contractual, privacy, and data-processing requirements before an engagement begins.

MessyOrg intends to make a Data Processing Addendum available for qualifying engagements. Until that document has been prepared and reviewed, we do not advertise one.

MessyOrg is an Approved Lovable Solution Partner. This is a technology platform partnership. It is not a security, compliance or privacy certification.

MessyOrg holds no security or compliance certification — no SOC 2, ISO 27001, HIPAA, PCI or equivalent — and makes no such claim. Where a credential is obtained, it will be named here and nowhere else.

The privacy notice on this site sets out what messyorg.com collects, why, and who it is shared with. Enquiry, proposal and chat submissions are used to reply to you and to scope an engagement.

Retention of the information you submit follows the Data retention section above. Specific retention requirements for an engagement may be defined in the applicable client agreement.

If you believe you have found a security issue in a MessyOrg product or website, email us and we will confirm receipt and investigate.

Please do not test against live client systems, access data that is not yours, or publish details before we have had a chance to respond.

Security questions, procurement reviews and disclosure reports go to MessyOrg directly and are answered by the founder.

General business inquiries are typically answered within one business day. Support availability and response targets are defined by the applicable MessyCare plan or client agreement.