FollowUp
Sign inStart free
Security

Security,
in plain words.

What it can see, how it’s kept, what you control, and what we haven’t done yet.

Updated September 27, 2026

What it can see

Only what you connect.

Read your emailgmail.readonlySend email as yougmail.sendAdd bookings to your calendarcalendar.eventsSee your email addressuserinfo.emailOutlook: read and sendMail.Read · Mail.Send

Disconnect any of them in Settings and access stops right away. To remove what’s already stored, delete it (below).

How it’s kept

Locked, and kept apart.

  • No FollowUp password
    You sign in with Google, so there’s none to steal.
  • Keys encrypted
    Connection keys are encrypted before they’re stored.
  • Deleting asks who you are
    You sign in with Google again first.
  • Kept to your business
    Other FollowUp customers never see it.
  • Closed to the internet
    The database answers only our server.
  • Everything written down
    Each message is recorded with its reason.
What you control

Yours to
switch off.

No need to ask us. It’s all in Settings.

SettingsWhat you control
  • Ask before every reply
    Or let FollowUp send them. Prices and dates still wait for you.
    Shown as on.
  • Stop all sending
    One tap holds everything.
    Shown as off.
  • Only admins send
    Teammates write; an admin sends.
    Shown as off.
  • New sign-in emails
    When a device we haven’t seen signs in.
    Shown as on.
  • Sign out everywhere
    Every device, within 5 minutes.
    Shown as a button.Sign out all
  • Your data
    Download it or delete it. Deleting is permanent.
    Shown as two buttons.DownloadDelete
Who else handles it

The companies we use.

Google
Sign-in, Gmail, Calendar
Microsoft
Outlook, if you connect it
Meta
Instagram, Messenger, WhatsApp, Lead Ads
Twilio
Texts and calls, if you connect it
OpenAI
Writes the drafts; doesn’t train on your data
Stripe
Billing
Supabase · Vercel
The database and the servers
Sentry
Error reports, contact details removed
Resend
The emails FollowUp sends you

We never sell your data. The details are in the Privacy Policy.

Not done yet

What we haven’t done yet.

We’d rather tell you than have you find out.

  • No outside security audit yet
    Larger companies show a SOC 2 report. We don’t have one yet. When we do, it goes here.
  • No outside penetration test yet
    No outside firm has tried to break in yet. It’s on our list.
  • Google hasn’t verified FollowUp yet
    Until it does, only people we add can sign in.
Something doesn’t look safe? Email contact@followupbase.io. Sahil, who builds FollowUp, reads every message.