Security
Your data stays yours.
Echo reads AI answers about your brand, not your customers' private data. What you put in is stored in Western Europe, kept apart from every other workspace, and only goes to the services that do the work. Here is exactly how.
- Stored in Western EuropeDatabase and files in Cloudflare's Western Europe region.
- No passwordsSign in with Google or a one-time email link.
- GDPR compliantRun from Berlin, with a public data processing agreement.
- EU AI Act compliantAI writes drafts; a person approves before anything goes live.
Hosting and data.
Echo runs entirely on Cloudflare, with your data stored in Western Europe.
- Cloudflare, end to endThe app runs on Cloudflare Workers, the database on Cloudflare D1 and files on Cloudflare R2. No other hosting.
- Stored in Western EuropeThe database and files live in Cloudflare's Western Europe region. Requests are answered by the nearest data centre, under Cloudflare's data processing agreement.
- Encrypted in transit and at restEvery connection is HTTPS only. Cloudflare encrypts the database and files at rest.
- Keys sealed twiceKeys and tokens you connect are encrypted again by Echo with AES-256-GCM and never shown again. API keys for Echo's own API are kept only as a fingerprint.
- Backups for 30 daysThe database keeps automatic point-in-time backups for 30 days, so it can be restored after a mistake or an outage.
Access.
Only the right people see a workspace, and nobody needs a password.
- No passwordsSign in with Google or a one-time link sent to your email. There is no password to leak or reuse.
- Sessions that endSessions end after 7 days without use. Sign-in links and invites expire, and sign-in emails are rate limited.
- Owners and membersOnly owners handle billing, API keys, webhooks and deleting the workspace. Guests in Brand assets see only what's shared with them.
- Workspaces kept apartEvery request checks that what it asks for belongs to the signed-in person's workspace, and automated tests check it on every change.
- Your own OpenAI keyA workspace can run drafts and the agent under its own OpenAI account. The key is encrypted; removing it deletes it at once.
- No looking inNobody at Echo opens your workspace unless you ask for support, for security or because the law requires it.
AI and the EU AI Act.
Echo is EU AI Act compliant: AI drafts, a person decides.
- Business AI APIs onlyEcho uses models from OpenAI, Anthropic, Google, Perplexity and xAI through their business APIs. None of them may train on what Echo sends.
- Not a high-risk systemEcho reads public AI answers and writes marketing drafts. It makes no decisions about people.
- Drafts, clearly markedWhat Echo writes starts in review, shows where it came from, and figures it can't trace to your facts are marked "Check this".
- A person approvesPages go into your website builder as drafts and outreach is sent by you. Echo never publishes, posts or emails outside your workspace by itself.
- Every AI call loggedThe agent and AI features say they're AI, and each AI call is logged with its cost, so you can see what ran.
GDPR.
Echo is GDPR compliant and run from Berlin, under EU data protection law.
- Clear rolesFor your account Echo is the controller. For data your workspace adds about others (leads, contacts, visitors), your company is the controller and Echo its processor.
- A public DPAThe data processing agreement (Art. 28 GDPR) applies to every workspace without signing anything.
- Export and deleteExport most tables as CSV. Delete your account in Settings → Account; workspaces only you use go with it, at once.
- As little as possibleNo IP addresses from the Echo tag, no cookies on your visitors, and AI crawler visits without anything personal.
- Your rights, by emailAsk for access, correction or deletion any time. You can also complain to a data protection authority.
Services Echo uses.
These providers process data for Echo under data processing agreements. Tools you connect yourself (Google Analytics, HubSpot, Attio, Framer, Webflow, WordPress, Slack, Claude or ChatGPT) get data only once you connect them, under your own terms with them.
| Provider | What for | What it receives | Where |
|---|---|---|---|
| CloudflareCloudflare, Inc., USA | Hosting, database, file storage, email forwarding, protection against attacks | Everything stored in Echo: accounts, workspaces and their data, files | Worldwide network; EU-US Data Privacy Framework and Standard Contractual Clauses |
| ResendResend, Inc., USA | Sending Echo's emails (sign-in links, reports, alerts, invites) | Recipient's email address and the email's content | USA; Standard Contractual Clauses |
| OpenAIOpenAI, L.L.C., USA | ChatGPT's answers, analysis of answers and websites, drafts, the Echo agent | Brand details, prompts, website text; for the agent, the chat and members' names (never email addresses). Not used for training | USA; Standard Contractual Clauses |
| AnthropicAnthropic PBC, USA | Claude's answers to the prompts | The prompts and the country they're asked from, nothing about people | USA; Standard Contractual Clauses |
| PerplexityPerplexity AI, Inc., USA | Perplexity's answers to the prompts | The prompts and the country they're asked from, nothing about people | USA; Standard Contractual Clauses |
| GoogleGoogle Ireland Ltd., Ireland | Gemini's answers (paid Gemini API); Sign in with Google | The prompts and their country; for sign-in, name, email address and profile picture | EU and USA; EU-US Data Privacy Framework |
| xAIX.AI LLC, USA | Grok's answers to the prompts | The prompts, nothing about people | USA; Standard Contractual Clauses |
| DataForSEODataForSEO (dataforseo.com) | Google's AI Overviews and AI Mode, SEO data, competitors' Google ads, Google searches for Mentions, Google listings and reviews | Prompts, keywords, website addresses and their country and language, nothing about people | Standard Contractual Clauses where data leaves the EU |
| Brave SearchBrave Software, Inc., USA | Whether Brave's search has the brand's pages, and where the brand ranks there for its tracked keywords | Website addresses, page titles and tracked keywords; nothing about people | USA; Standard Contractual Clauses |
| StripeStripe Payments Europe, Ltd., Ireland | Payments, invoices and VAT | Billing name, email and address, VAT ID; card details go straight to Stripe | EU and USA; EU-US Data Privacy Framework and Standard Contractual Clauses |
- CloudflareCloudflare, Inc., USA
- What for
- Hosting, database, file storage, email forwarding, protection against attacks
- What it receives
- Everything stored in Echo: accounts, workspaces and their data, files
- Where
- Worldwide network; EU-US Data Privacy Framework and Standard Contractual Clauses
- ResendResend, Inc., USA
- What for
- Sending Echo's emails (sign-in links, reports, alerts, invites)
- What it receives
- Recipient's email address and the email's content
- Where
- USA; Standard Contractual Clauses
- OpenAIOpenAI, L.L.C., USA
- What for
- ChatGPT's answers, analysis of answers and websites, drafts, the Echo agent
- What it receives
- Brand details, prompts, website text; for the agent, the chat and members' names (never email addresses). Not used for training
- Where
- USA; Standard Contractual Clauses
- AnthropicAnthropic PBC, USA
- What for
- Claude's answers to the prompts
- What it receives
- The prompts and the country they're asked from, nothing about people
- Where
- USA; Standard Contractual Clauses
- PerplexityPerplexity AI, Inc., USA
- What for
- Perplexity's answers to the prompts
- What it receives
- The prompts and the country they're asked from, nothing about people
- Where
- USA; Standard Contractual Clauses
- GoogleGoogle Ireland Ltd., Ireland
- What for
- Gemini's answers (paid Gemini API); Sign in with Google
- What it receives
- The prompts and their country; for sign-in, name, email address and profile picture
- Where
- EU and USA; EU-US Data Privacy Framework
- xAIX.AI LLC, USA
- What for
- Grok's answers to the prompts
- What it receives
- The prompts, nothing about people
- Where
- USA; Standard Contractual Clauses
- DataForSEODataForSEO (dataforseo.com)
- What for
- Google's AI Overviews and AI Mode, SEO data, competitors' Google ads, Google searches for Mentions, Google listings and reviews
- What it receives
- Prompts, keywords, website addresses and their country and language, nothing about people
- Where
- Standard Contractual Clauses where data leaves the EU
- Brave SearchBrave Software, Inc., USA
- What for
- Whether Brave's search has the brand's pages, and where the brand ranks there for its tracked keywords
- What it receives
- Website addresses, page titles and tracked keywords; nothing about people
- Where
- USA; Standard Contractual Clauses
- StripeStripe Payments Europe, Ltd., Ireland
- What for
- Payments, invoices and VAT
- What it receives
- Billing name, email and address, VAT ID; card details go straight to Stripe
- Where
- EU and USA; EU-US Data Privacy Framework and Standard Contractual Clauses
Every detail, with how long each thing is kept, is in the privacy policy.
Report a problem.
Found a security problem? Write to security@echo-aeo.com with what you found and how to see it. We answer within two working days, fix what's real and credit you if you like. Please give us time to fix it before telling others, and don't access other people's data or disrupt the service while testing.
FAQ
Questions.
Is Echo SOC 2 or ISO 27001 certified?
Not yet. Echo is a young company and doesn't claim certifications it doesn't hold. This page describes what Echo actually does; write to us for a security questionnaire or a call.
Where is my data stored?
In Cloudflare's Western Europe region (database and files). Cloudflare answers requests from its nearest data centre, and the AI providers that answer the prompts are in the USA, under the EU's Standard Contractual Clauses and, where they're certified, the EU-US Data Privacy Framework.
Do AI providers train on our data?
No. Echo uses business APIs whose terms keep API data out of training. The prompts Echo asks carry nothing about people, and the agent never sends email addresses.
Can we sign a data processing agreement?
Yes. Echo's data processing agreement is public on /dpa and applies to every workspace without signing anything. Write to us if you need a signed copy.
Can Echo publish to our website?
Only when a member of your workspace clicks Publish and confirms. Everything else goes into your website builder as a draft.