Trust & security
Last updated October 18, 2026
Where your record lives
Stored in Canada. Gus's AI runs through Anthropic, which doesn't train on your entries. Your account, entries and chats are stored in Supabase's Canada Central region. A nightly backup, encrypted with a key only Gusset holds, is kept for 30 days in Cloudflare's storage in North America. Gusset takes words only: there is no way to attach a file or a photo.
How it's protected
- Encrypted in transit (HTTPS everywhere) and at rest.
- Each account can read and change only its own rows; the database enforces this, not just the app.
- Sign-in by a code sent to your email, or with Google: Gusset has no password to steal.
- Limits on how often anything can be asked, and a strict content security policy.
- No advertising, no trackers, no session recording, no chat widgets.
AI
Gus is AI. What you type is sent to Anthropic, in the United States, to file your entries and check your examples. Under Anthropic's commercial terms it is not used to train their models. Gus can be wrong: review what Gus files before you submit anything.
Gus never writes your competency examples. Gusset keeps you on the right side of your regulator's AI rules. Voice runs through Deepgram (US), which keeps nothing after each request and doesn't train on it. Gusset never stores audio.
Who processes your information for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Canada (Central) |
| Anthropic | Gus: filing entries, checking your examples and placing your own sentences, what Gus says in voice mode | United States |
| Deepgram | Voice: your speech to text, and Gus's replies to speech. Keeps nothing after each request, trains on nothing | United States |
| Cloudflare | Hosting the site, protection from abuse, page-view counts without cookies, the person check on sign-in and the contact form, and the nightly backup (encrypted with a key only Gusset holds) | Worldwide network, including the United States; backup in North America |
| Stripe | Payments | United States and Canada |
| Resend | Sending email | United States |
| Sentry | Error reports only, with personal details scrubbed (no entry text, no email or IP addresses) | United States |
| Signing you in, only if you choose to. Google never sees your record | Where Google runs its sign-in |
We never sell your information, never use it for advertising, and never use your record to train AI. Each of these providers may use it only to provide its service to us.
If something goes wrong
If a breach creates a real risk of significant harm, we tell the people affected and the Privacy Commissioner of Canada as soon as feasible. We keep a record of every breach for at least 24 months. No system is perfectly secure, and we don't promise that ours is.
To report a security problem, write to support@gussetlog.com. We read every report and won't take action against anyone who reports a problem in good faith.
Your data, your call
Download everything we hold, or delete your account and everything in it, from Settings, at any time.