We do not put a compliance badge on this page that we cannot substantiate.
01
Isolation is never optional
Every workspace belongs to one company.
Queries, conversations, jobs, customer records, files, retrieval context, and other workspace data are scoped to that company's organizationId.
A user from one business must not see another business's conversations, jobs, customers, or files.
Isolation is enforced by the application rather than being a preference a customer has to turn on.
02
AI does not cross companies
WhatTheJob may use AI to draft requests, draft responses, or retrieve information relevant to a conversation.
That retrieval is scoped to the Business Client's workspace.
The model may use that company's:
- Services and catalog
- Hours
- Service areas
- FAQs
- Relevant customer history
- The current customer's conversation
It does not intentionally retrieve another company's conversations, jobs, catalog, FAQs, or customer records.
Empty context is better than another company's history.
03
AI suggests. Software validates. You approve.
The model can draft.
Software applies deterministic product rules where applicable.
A person creates and approves the job.
AI does not independently create a job or assign a crew member.
Prices, catalog values, and loyalty balances are not supposed to be invented by the model and treated as authoritative business data.
04
Roles on the desk
Not every workspace user sees the same information.
Owners, admins, dispatchers, and crew have different roles and permissions.
Insights are limited to the roles that are intended to access them.
Crew members use the Crew App rather than the office-facing operations interface.
Access is enforced by the application.
05
Data protection
Production traffic uses HTTPS/TLS.
Our managed database and file storage use encryption at rest.
Integration secrets are stored using encrypted secret storage.
We maintain backups as part of operating the service.
We also use access controls, logging, monitoring, and operational security practices designed to protect the service and workspace data.
06
Workspace data
WhatTheJob stores and processes workspace information because the product is an operational system, not a message relay.
Depending on the Business Client's configuration, workspace data can include:
- Customer profiles, contacts, and locations
- Conversation messages
- WhatsApp media and other attachments
- Drafted requests
- Jobs, notes, checklists, photos, signatures, and status
- Survey responses
- Loyalty information
- Company information, catalog, hours, FAQs, and service areas
- Workspace users, roles, and crew
End customers do not log into the workspace. Their communications arrive through supported channels and may become part of the Business Client's operational record.
07
AI and customer data
We do not train or fine-tune a WhatTheJob foundation model on customer or end-customer workspace data.
WhatTheJob does use third-party AI models to process information when the product needs to draft or retrieve.
This is inference: information is sent to an AI service so it can perform a requested product function. It is not training a WhatTheJob model on the Business Client's data.
Specific AI providers, subprocessors, retention terms, and processing arrangements are governed by the Business Client's agreement.
08
The human gate
The model can be wrong.
That is why the product keeps a person in the operational loop.
A customer message can become a drafted request. A person reviews the work and creates or approves the job. The system does not treat an AI draft as an automatically authorized job.
09
Backups and offboarding
We maintain backups to support operation and recovery of the service.
We do not currently publish a fixed number of days after which all workspace data is automatically deleted.
When a workspace ends, access can be disabled or suspended. Workspace data deletion or return is handled according to the applicable Business Client agreement and our operational processes.
We do not keep workspace data to train a WhatTheJob model or use it as shared context for another Business Client.
10
What we do not claim
We do not currently claim on this page:
- SOC 2 certification
- GDPR certification
- A particular data-residency region
- A dedicated infrastructure stack for every customer
- Zero-retention AI processing
- That workspace data never leaves our infrastructure
- That every third-party provider uses the same retention or residency terms
Those details depend on our infrastructure, providers, contracts, and the Business Client's applicable agreement.
11
Report a security concern
If you believe you have found a security issue involving WhatTheJob, contact hello@arctrait.com or hello@whatthejob.ai.
Please include enough information for us to understand and investigate the issue.
12
Related
Privacy covers the marketing site.
Terms covers use of the marketing site and the relationship between these public terms and a Business Client agreement.
Contact sales if you want to discuss a workspace.