Security & data

How Vanerra handles your data.

Last updated October 10, 2026

Your inbox, messages and bank statements hold your customers' trust and your business's money. Here is exactly what Vanerra can see, what it keeps, who processes it, and how you stay in control.

In short

• New assistants start in approval mode: nothing is sent to a customer until you approve it, unless you choose a more automatic mode.
• Vanerra can read and send email (Gmail or Outlook) and read and reply to Instagram and Facebook Messenger messages you connect. It never deletes, archives or labels your email.
• Vanerra never moves money. Bank and card statements you upload are read to build reports and plans only.
• Your data is never sold, never used for advertising, and never used to train AI models.
• You can disconnect any connection, delete your financial data, or delete your whole account yourself, at any time.

What Vanerra can access

• Gmail (Google): read messages and send email from your address. Used to spot new customer inquiries, measure reply times and send the replies you allow. Newsletters, receipts and automated mail are skipped.
• Outlook / Microsoft 365: read messages (Mail.Read) and send email from your mailbox (Mail.Send), for the same purposes as Gmail. Connections made before sending was added stay read-only until you reconnect.
• Google Calendar or Outlook Calendar (Booking Assistant): see when you are busy, and create or change events for the appointments it books.
• Instagram and Facebook Messenger (Meta): read direct messages sent to your connected Instagram professional account or Facebook Page and send replies from it; capture Facebook Lead Ad sign-ups; and, for Instagram, read profile and reach insights.
• Google Business Profile: read new reviews and profile performance (calls, website clicks, directions) and post review replies you approve.
• HubSpot, Jobber, Housecall Pro, ServiceTitan: import customer contact details, deals, quotes and estimates to find follow-ups worth sending.
• QuickBooks (Intuit) and Square: import customers, estimates and invoices to follow up on open estimates and send polite reminders about overdue invoices.
• Business texting and calls (only if you turn it on): a local number through Telnyx for missed-call text-back and two-way texting.
• Financial statements you upload (AI Business and the free trial): bank, card and profit-and-loss statements as PDF or CSV.
• Your website: only public pages, the same way a visitor sees them. We never log in or submit forms.

What Vanerra stores

• TikTok: read your TikTok display name and public videos. Vanerra does not read or send TikTok messages.
• Customer conversations it handles (email, Instagram, Messenger, website chat and forms, texts): the customer's name and contact details, the text of their messages and replies (up to 5,000 characters each), replies prepared and sent, and a log of every action taken.
• Deep audit: read-only. Only numbers and short findings are kept (reply times, unanswered counts), not message content.
• Financial statements: the uploaded file is encrypted (AES-256-GCM, with a key separate from connection credentials) and kept in a private storage bucket that is never served back to browsers. The file is deleted automatically after your retention period (90 days by default; you choose 1 day to 7 years). The transactions read from it are kept, with account and card numbers masked, until you delete the statement or all financial data.
• Not stored: email attachments, and emails or messages that are not customer conversations Vanerra is handling.

AI processing

Replies, summaries, the Morning Brief, Ask Vanerra answers and statement reading are produced by Anthropic's Claude through its commercial API. Only the text needed for the task is sent, for example a customer's message and your approved business information, or the text of a statement. Under Anthropic's commercial terms this data is not used to train its models. For the deep audit, subject lines and previews are anonymized (email addresses and numbers removed) before any AI sees them. Figures in financial answers are calculated by our own code from your data, not invented by the AI.

You stay in control

• Choose per assistant: approve everything, let routine work through, or set limits for full automation, with business hours and daily limits.
• Pause any assistant instantly. Every action is logged with its reason in your dashboard.
• Customers marked do-not-contact are never messaged; complaints and sensitive requests always come to you.
• Team roles (owner, admin, sales, viewer) limit who can change settings, see billing or finances, or approve messages. Each account has up to 10, 25 or 50 people depending on its plan, including pending invitations.

Security

• Connection credentials (Google, Microsoft, Meta, Intuit, Square, HubSpot, Jobber and others) are encrypted at rest (AES-256-GCM), used only on our servers, and deleted when you disconnect. Disconnecting Google also revokes access at Google.
• All traffic is encrypted in transit (HTTPS with HSTS).
• Each business's data is isolated at the database level, and that isolation is covered by automated tests.
• Error monitoring is configured to exclude customer emails, IP addresses and message content.

Who processes your data

Deleting your data

• One connection: disconnect it from Connections. Its stored credentials are deleted.
• Financial data: delete a single statement (its file and transactions), or delete all financial data at once, from Finances → Your data.
• Everything: Dashboard → Account → Delete account. Your subscription is cancelled immediately, connections are revoked and your business's data is removed. Invoices remain with Stripe for accounting.
• Instagram and Facebook data: see Meta data deletion.

Questions, security reviews and agreements

Need a data processing agreement, a completed security questionnaire, or have a question your IT team wants answered? Email shemar@unaviatech.com. See also the privacy policy and terms.