Even though the Porsche Desk app is currently a demo, the technology that moves data in the Backend is well-established. In a variety of different applications, our "Work-API" is trusted by hundreds of businesses.
We take our responsibilities regarding your data very seriously, and have built both the app and the API around data privacy at its core from the start.
Your work content remains with your tool provider (e.g. Gmail).
We do not host your personal work content anywhere on our systems.
livil acts as a secure pipe that your content passes through.
We do not index your content unless required for the work process. Search functionality is powered by the tool providers.
We execute the work process you request, and nothing else.
We do not use our access permissions for anything other than the requested work process.
Example: You request "Inbox" / say "What is the latest?"
The app interprets your request and sends it to the API.
On your behalf, the API requests the list of emails from the accounts you connected.
The integrations each send the requested information.
Like a pipe the API then passes through the consolidated information to the app, where it is provided to you.
A few tips to get you going with the voice interface of the prototype.
Your Content:
We fetch and display your content (e.g. emails, calendar events) solely for the work process you request.
When you connect integrations to your account, we do not see your username and password. We receive a token from the tool provider (e.g. Gmail) that gives us the permission to access the content you request.
When you remove an integration (and/or delete your account) the token is no longer valid and we can no longer access the corresponding content.
Account Data:
When you create an account we receive the personal info you provide (e.g. your name or email address) and solely use it for the provision of the service.
When you delete your account, all that data will be irretrievably deleted.
Passwords for different work tools:
At initial setup you enter your passwords for your different accounts (e.g. Gmail, Outlook Calendar) exclusively on the pages of the tool provider (e.g. Google, Microsoft 365).
We neither see any passwords for any of your tools, nor do we store them.
After you established the connection we receive an access token from the tool provider (Info see below).
Passcode for the Porsche Desk account:
Independent from your passwords for your tool accounts, at first registration you set up a six-digit passcode for the Porsche Desk app, that (in combination with your account name) provides access to the Porsche Desk app.
We receive an access token from the tool provider for each integration that you connect to the Porsche Desk app.
These access tokens allow this specific app only to perform the work processes (fetch email list, create event, ...) on your behalf.
To keep the triangular setup secure, the tokens are secretly exchanged between the user, the tool provider and us, and last only for an hour.
You can at any point revoke the Porsche Desk app's access to your content.
You can do this from inside the app
e.g. by deleting your Porsche Desk account
e.g. by removing an integration
You can also revoke permissions for any third party app from your account provider
e.g. for Google accounts: https://myaccount.google.com/u/1/security
After you revoke access the app immediately loses access to your connected accounts.
Account info: Information you provided when you created the account, such as your name or email address.
Access tokens for your different integrations, where provided (and not revoked).
We monitor anonymized usage data to help improve the app and for security purposes.
We use AWS (Amazon Web Services) for everything, with servers in the European Union.
AWS security measures are second to none and can be seen here.
The following is a selection of the measures we employ.
Content remains hosted by content providers
No server-side caching
Isolation of services
No plain text communication whatsoever: everything encrypted; data encrypted at rest (in DB)
Exceeding content providers’ security requirements (e.g. Gmail OAuth)
Monitoring for "unusual activity" (e.g. changes of access location or timing)
Regular and thorough independent security assessments / penetration tests
Through a series of measures we minimize the risk of a breach and we minimize the implications of a breach, should they occur.
We go through a series of assessments and constantly review our own solutions.
Being a business ourselves with our own sensitive data, we understand any concerns you may have. We were in the same position and worked hard to make our system secure, before we connected our own real accounts.
Please find the Privacy Policy here: https://www.work-api.com/privacy/
The Terms of Use can be found here: https://www.work-api.com/terms/
Beyond our own actions and precautions, your local laws and regulations protect you and the use of your data by third parties.
As one example, in the European Union, the service is subject to the "General Data Protection Regulation" (GDPR), amongst others.
Our solution, on your own servers
As we leave the prototype stage, we are happy to provide the option for you to host the solution on your own infrastructure.
Hold all the keys in your own pocket
Only the party who hosts the application holds the keys and the user data.