Security

Villages remembers people, not conversations.

Updated 9 October 2026. Plain words, no badges we have not earned. The privacy policy says what we store and why; this page says how it is protected.

The short version

Villages gathers context on its own servers from your email (Gmail or Outlook: who you write to and when, never the message) and your calendar, and, if you connect them, your call recorder and LinkedIn export. It does not keep your emails. What it keeps is who you know, when you were last in touch, and short notes such as “introduced Maya to Amara, 2 Nov”. Every request is tied to your sign-in and can only touch your own store. You can see everything it holds, download it, or delete all of it, at any time, without asking us.

Where things live

Passing through, never kept. From email, Villages asks only for who and when; that permission cannot fetch the text of a message. Call transcripts pass through our server to be turned into short notes, in memory, and are then thrown away. They are never written to disk or to a log. If you are invited to the email edition and connect a mailbox for it, the text of threads that look like introductions passes through in the same way, and what is kept is one line and a pointer to the thread.

In your private store on our server.Names, roles, companies, who knows who, dates of contact, the introductions you have made and what came of them, short notes with their source, your settings. One isolated store per person, on Railway in the EU (West), reachable only with a valid sign-in for that person. There is no code path from one person's store to another's, and nothing from your mailbox is ever used to answer someone else's question.

In a shared database.Only things that are public or belong to more than one person: public research, a network's own records (its member directory, asks and introductions), a register of who is who (names and fingerprints only), and Villages for Teams records (companies, open roles, referrals). Nothing from your private store is ever copied there. Hosted by Supabase in Paris.

With the people you write to. Only what you send. Villages never emails anyone in your network, and never sends from your mailbox on its own.

How access works

Sign-in is handled by WorkOS. The web app, the browser extension and the Teams pages all present a signed token for your account; the server checks the signature on every request and only then opens your store. Everything travels over TLS. Your private store is encrypted at rest with a key derived for your account, so no two stores share a key and a copy of the disk is unreadable. Mailbox connections and recorder keys are encrypted the same way. Villages is run by its founder, AJ (Edward Ashton Johnson), who can technically reach the server that holds the stores; in practice your data is opened only to support you at your request, to debug with your permission, or if the law requires it.

What you control yourself

Download everything. One click gives you a zip of your whole store as readable files.

See what has touched your store. An access log lists every read and write, in plain words, newest first.

Erase everything. Your store, identity, mailbox and recorder connections and sessions are removed at once, and backups clear within 30 days. There is no undo, and no email to us is needed.

Disconnect a mailbox. Everything stops within the hour and its key is removed.

Never signed up? If someone asked you for an introduction, or was introduced to you, you can ask what is held about you and have it removed. Email aj@villages.work.

What we do not do

Your data is not, and never will be, sold. No advertising, no training of AI models on your data by us or by anyone we work with, no combining of what different people know about the same person, no data brokers, no health details about other people, and no automated browsing of LinkedIn or anyone else's site.

How AI is used

Villages uses two AI providers, Anthropic and DeepInfra, both based in the US, to turn your material into short notes. Your store stays in the EU; the text a task needs is sent to the provider under the UK's approved safeguards for transfers to the US, and is not kept there. Neither may train on your data. Each gets only the text one task needs. Looking people up online sends only a name and a work detail such as a company, through a search provider, Exa. The privacy policy has the detail.

Honestly, where we are

Villages is an early product. What is real today: registration with the ICO (C2045507), authenticated per-user isolation, EU hosting, encrypted transport, private stores and keys encrypted at rest, self-serve export, access log and erasure. What is not yet: an independent penetration test, Cyber Essentials, SOC 2 (built to its controls, now in progress). We would rather you knew than assumed.

Reporting a problem

If you find a vulnerability or something that looks wrong, email security@villages.work. We will acknowledge within two working days, keep you informed, and credit you if you want. Please do not access anyone else's data in the course of testing; a proof that you could is enough. Our /.well-known/security.txt carries the same contact.

If we ever have a breach that affects you, you will hear it from us directly and promptly, and the ICO will be told within 72 hours as the law requires.