Trust Center
How we approach security, ownership, data, infrastructure, AI, and production software.
This page describes how MessyOrg works. It does not claim any certification, audit outcome or regulatory compliance status, and nothing here replaces the terms of an engagement agreement.
MessyOrg documents its security, data, ownership, and technology practices based on controls actually in place. We do not claim certifications, compliance programs, or guarantees we have not established.
MessyOrg believes trust requires clear expectations before software reaches production. We document how client data is handled, which providers are involved, how ownership is defined, how support works, and how incidents are addressed.
Security, ownership, support, and data responsibilities are discussed as part of the engagement rather than discovered after launch.
Client data isolation
Every client record in the MessyOrg workspace is scoped to that client, and database policies enforce the scope rather than the interface.
Source code & ownership
Ownership of client-specific application code, MessyOrg proprietary technology and third-party technology is defined in the engagement agreement.
Testing & verification
Verify is a stage of every engagement, not an optional extra: what was built is tested, documented and reviewed against the agreed scope before launch.
Data retention
Unless otherwise agreed, MessyOrg ordinarily retains client project data for the duration of an engagement and for up to 90 days following completion or termination. Different retention requirements may be established in the applicable agreement.
Full detail
MessyOrg builds on managed cloud platforms rather than self-managed servers, so patching and platform hardening sit with the provider.
Applications are built with authentication and row-level access rules by default, so a signed-in user can reach only the records they are entitled to.
Security is treated as part of scope, not an add-on: access rules, roles and data handling are agreed during Design and checked during Verify.
Enquiries, proposal requests and chat messages submitted on messyorg.com are stored in MessyOrg's own managed database and are readable only through server-side, owner-authenticated access.
We ask for the information needed to scope work, and nothing else. Form submissions are used to respond to you and to scope an engagement.
Client production data belongs to the client. What MessyOrg may access, and for how long, is defined per engagement.
The MessyOrg client workspace uses email and password sign-in with email confirmation, and roles are stored separately from user profiles so a user cannot grant themselves access.
Client workspace access is invite-only: an account only sees a workspace when its email has been invited by MessyOrg.
Applications we build for clients use the same pattern, explicit roles, server-side checks, and least privilege by default.
Every client record in the MessyOrg workspace is scoped to that client, and database policies enforce the scope rather than the interface.
Client engagements are separate projects with their own database, credentials and deployment. Client data is not pooled across engagements.
messyorg.com and the MessyOrg products run on managed hosting with managed Postgres, served over HTTPS.
Infrastructure choices for a client engagement are agreed during Design and documented at handoff, including what is needed to run and redeploy the application.
API keys and other secrets are stored as server-side environment secrets, never in front-end code or in the repository.
Secrets are readable only by server-side code. At handoff, credentials are transferred to the client's control or rotated.
AI features in MessyOrg products and in client applications are built deliberately: a defined task, defined context, and guardrails on what the model can act on.
The assistant on this website sends the conversation to a hosted model to answer questions and, where you offer them, to record your contact details so we can reply.
AI is used to help build and explain software. Decisions about architecture, data and access are made and reviewed by people.
MessyOrg uses third-party technology providers where necessary to design, build, host, operate, monitor, communicate, and support software. The providers involved vary by engagement.
The current provider list, with the purpose and the data involved for each, is set out under Third-party technology providers below.
Ownership of client-specific application code, MessyOrg proprietary technology and third-party technology is defined in the engagement agreement.
See Ownership & handoff below for how MessyOrg separates those categories.
Verify is a stage of every engagement, not an optional extra: what was built is tested, documented and reviewed against the agreed scope before launch.
MessyProof is our own verification technology, it examines a codebase's architecture, dependencies, configuration and changes so the state of a build is visible rather than assumed.
A verification review reports detectable configuration and implementation signals. It is not a security certification or a guarantee of production readiness.
Applications are deployed with platform-level logging so errors and failed requests can be investigated.
What is monitored, what counts as urgent, and how issues are raised is agreed at the start of a MessyCare engagement.
When client data is scheduled for deletion, MessyOrg removes or initiates removal of applicable information from active systems according to the agreed retention requirements. Residual copies may temporarily remain in encrypted or provider-managed backups until those backups expire through their normal lifecycle.
MessyOrg systems use the managed database platform's built-in backup capability rather than a separately operated backup estate.
Where MessyOrg controls or can configure the applicable backup lifecycle, residual backup data should ordinarily expire within a further 90 days.
MessyOrg does not claim the ability to independently delete information from immutable or provider-controlled backups. Retention of those copies is governed by the provider's own policies.
Backup frequency, retention and recovery expectations for a client engagement are agreed during Design and written into the plan.
Security or privacy concerns can be reported to MessyOrg for review and appropriate response.
MessyOrg follows a documented sequence when a potential security, privacy, availability or data incident is identified.
If something goes wrong on a MessyOrg-supported application, the route is direct: one company, one accountable contact, no ticket triage layer. The eight steps below set out what happens next.
Notification timing is governed by the applicable agreement or by law. MessyOrg does not publish a guaranteed notification window.
MessyOrg does not operate a 24/7 security operations centre or a dedicated security team, and makes no claim of guaranteed containment times, guaranteed recovery times, forensic capability or security certification.
MessyCare is the ongoing support arrangement that carries an application after launch: changes, integrations, monitoring follow-up and the questions that arrive once real work runs through the software.
MessyCare is $499/month with up to 5 hours and initial response within 2 business days. MessyCare Plus is $1,000/month with up to 10 hours, priority scheduling, and initial response within 1 business day. Initial response is not guaranteed resolution.
Support availability and response targets are defined by the applicable MessyCare plan or client agreement. MessyOrg does not claim 24/7 support, guaranteed uptime, guaranteed resolution or guaranteed response times.
General business inquiries are typically answered within one business day.
Support availability and response targets are defined by the applicable MessyCare plan or client agreement.
Contractual service levels, if any, are defined in the applicable agreement. Nothing on this page creates a service-level commitment.
Unless otherwise agreed, MessyOrg ordinarily retains client project data for the duration of an engagement and for up to 90 days following completion or termination. Different retention requirements may be established in the applicable agreement.
This is a baseline. It describes how MessyOrg ordinarily handles client project data, not a promise that every copy of every record is erased on a fixed date.
Clients can request deletion of their project data at any point. Where deletion is technically and legally possible, MessyOrg carries it out or initiates it; where it is not, we say so and explain what remains and why.
Retention may run longer where: continued retention is required by the applicable agreement; records must be kept as legitimate business records; applicable law requires retention; information must temporarily remain in provider-managed backups until those backups expire.
Requesting deletion. A deletion request can be sent to MessyOrg directly, or raised through the client workspace during an engagement. We confirm what was deleted, what is scheduled for deletion, and anything that must be retained.
Organizations with specific data-processing requirements may contact MessyOrg to discuss contractual, privacy, and data-processing requirements before an engagement begins.
MessyOrg intends to make a Data Processing Addendum available for qualifying engagements. Until that document has been prepared and reviewed, we do not advertise one.
MessyOrg holds no security or compliance certification, no SOC 2, ISO 27001, HIPAA, PCI or equivalent, and makes no such claim. Where a credential is obtained, it will be named here and nowhere else.
The privacy notice on this site sets out what messyorg.com collects, why, and who it is shared with. Enquiry, proposal and chat submissions are used to reply to you and to scope an engagement.
Retention of the information you submit follows the Data retention section above. Specific retention requirements for an engagement may be defined in the applicable client agreement.
If you believe you have found a security issue in a MessyOrg product or website, email us and we will confirm receipt and investigate.
Please do not test against live client systems, access data that is not yours, or publish details before we have had a chance to respond.
Security questions, procurement reviews and disclosure reports go to MessyOrg directly and are answered by the founder.
General business inquiries are typically answered within one business day. Support availability and response targets are defined by the applicable MessyCare plan or client agreement.
Incident response
MessyOrg follows a documented sequence when a potential security, privacy, availability or data incident is identified.
01
Receive or detect a potential security, privacy, availability, or data incident.
02
Determine affected systems, severity, scope, and immediate risk.
03
Take reasonable steps to limit continued exposure or operational impact.
04
Determine what occurred, the affected systems and data, the timeline, and contributing factors.
05
Correct the issue, rotate credentials where appropriate, patch vulnerabilities, restore affected services, or take other necessary corrective action.
06
Where required by the applicable agreement or law, notify affected clients or other appropriate parties using available verified information.
07
Restore normal operations and verify that remediation is effective.
08
Document lessons learned and identify improvements to reduce recurrence.
Notification timing is governed by the applicable agreement or by law. MessyOrg does not publish a guaranteed notification window.
MessyOrg does not operate a 24/7 security operations centre or a dedicated security team, and makes no claim of guaranteed containment times, guaranteed recovery times, forensic capability or security certification.
Optional ongoing care
Ongoing care starting at $499/month. Choose dependable maintenance or more room for regular improvements—even if MessyOrg didn’t build your website, application, or systems. We confirm supported systems and coverage before work begins.
$499/month
For businesses that need dependable maintenance and occasional updates to their website or application.
Initial response: within 2 business days
Discuss MessyCare$1,000/month
For businesses that need ongoing maintenance and regular improvements.
Initial response: within 1 business day
Discuss MessyCare PlusInitial response means acknowledging and assessing your request, not guaranteed resolution. Care is optional after launch, not unlimited support or a promise to complete every request within the monthly allowance. No 24/7 availability, guaranteed uptime, or comprehensive security monitoring is included.
Third-party technology
MessyOrg uses third-party technology providers where appropriate to design, build, host, operate, monitor, communicate, and support software. Providers vary by engagement.
The list below covers the providers behind messyorg.com and the MessyOrg client workspace. Providers introduced into a client engagement are named in that engagement's proposal and documentation, so the dependency is a decision rather than a surprise.
Each provider remains governed by its own terms and privacy documentation.
Application development
Hosting
Database
Authentication
AI providers
Ownership & handoff
Ownership shouldn't become unclear after launch. Every MessyOrg engagement defines what belongs to the client, what remains MessyOrg intellectual property, what is governed by third-party providers, and what is included in the final handoff.
Client data
The data your organization and its users put into the application is your data.
Client-specific application code
Code written specifically for your engagement is identified in the agreement, along with the terms that apply to it.
Client accounts
Accounts with platforms, hosting and third-party providers are set up so your organization can hold them.
MessyOrg proprietary technology
MessyOrg products and reusable components remain MessyOrg intellectual property, used under the terms set out in the agreement.
Third-party technology
Platforms, libraries and services stay governed by their own providers' licences and terms.
Documentation
How the system is put together, what it depends on and how to operate it is written down and handed over.
Credentials
Keys, secrets and access are transferred or rotated into your organization's control at handoff.
Deployment
Where and how the application runs is documented, including what is needed to deploy it again.
Handoff
Handoff is a defined part of the engagement, not an afterthought: documentation, walkthrough, access and open items.
This describes how MessyOrg approaches ownership. Final ownership and licensing terms are defined in the applicable agreement for each engagement.
Contact
Security questions, disclosure reports or a procurement review, send them to us directly and the founder will respond.
Contact MessyOrg
