Sugarbug Security: Your Data Stays Yours on the Way Out

Sugarbug security: user-space scraping, medical-grade commitments, no lock-in, no model training on your data. Private by architecture, not policy.

Chris Calo·17 Apr 2026·11 min read

What Sugarbug can see (and what it cannot)

Sugarbug operates in user-space. It scrapes with your permissions, reads from your accounts, and sees exactly what you see – nothing more, nothing less. That one architectural property has genuinely profound consequences for how your data is treated.

Administrators cannot read your private messages. In most workplace products, when you leave a company your old account becomes the employer's archive. Sugarbug closes that door before it opens. An org administrator can only ever see what the org itself can already see – the public channels, shared docs, group calendars. Your private connectors are yours alone, full stop.

Joining an org is instant. New members get a single, pre-processed aggregate source that stitches together everything a member would normally see – public Slack channels, group meeting notes, shared Notion docs, Linear tickets, Figma changes, public PRs – de-duplicated and already indexed by the org's compounded graph.

Leaving an org is clean. When you disconnect, you lose access to the org's aggregate source and its signals, and nothing more. Your private connectors remain yours. Your history, your notes, and your personal graph all travel with you to the next place.

KEY TAKEAWAY

User-space scraping is the load-bearing decision. It is what makes private messages private, what keeps the portable graph portable, and what turns "your data is yours" from a marketing line into a property of the system.

The journal model

Think of how someone might keep a private notebook across a career. Year over year it fills with the people they meet, what they are thinking, how a moment hit them, what they learned from a rough week. That journal belongs to the person who wrote it.

Sugarbug is that journal scaled out into a full working knowledge graph: your private context (DMs, notes, one-on-ones) and the org's shared context (Slack threads in public channels, Linear tickets, shared docs) stitched into one personal system without blurring the lines between them. Private to the individual, helpful to the team when the individual chooses to share, portable when the person moves on.

Because private and public are indexed together, instead of sitting in separate tools, working in public becomes the most efficient way to operate. You do the work, the shared context updates itself, and the private journal model stays private.

Sugarbug is that journal scaled into a full working knowledge graph, without blurring the line between what is yours and what is shared.

What ships today

These are not roadmap items. These are the pieces of Sugarbug security that are already in the code, running in CI, and sitting behind every commit that goes out.

• Passwordless sign-in. Authentication is OAuth-only across five identity providers. There are no passwords to phish, leak, or reuse.
• Encrypted everywhere. Sensitive payloads at rest use authenticated AES-256-GCM; connections use TLS 1.3 with HSTS preload on every public endpoint.
• Tenant isolation at every layer. Every query and every vector search is scoped to the caller, and cross-tenant leakage is probed by automated tests on every CI run.
• Administrative actions are visible. Tamper-evident audit logs cover impersonation, account changes, and data purges.
• Security is part of the build pipeline. Custom automations scan every commit for leaked secrets, vulnerable dependencies, and code quality regressions.
• Safe deploys. Health-checked blue-green rollouts revert themselves automatically if anything goes wrong, before your users notice.
• Authenticated channels everywhere. The desktop client, the local agent that runs alongside it, and our servers communicate over authenticated, encrypted channels.

What launch adds

The "what ships today" list is the foundation. Production launch is where we add the controls that large buyers call "table stakes" after asking for them across a 14-tab spreadsheet.

• Customer-managed encryption keys. Your key management system holds the keys. Sugarbug operators cannot decrypt your data, even with full server access.
• Bring your own LLM. Route enrichment through your preferred provider – OpenAI, Anthropic, Google, or a self-hosted open-source model.
• PII stripped before every LLM call. Whatever model you route to, every enrichment payload has names, emails, phone numbers, addresses, keys, and identifiers replaced with reversible tokens before it reaches the model.
• Keychain-backed credential storage on the desktop client. Your integration tokens live where only your operating system can reach them.
• Signed and notarised application binaries with signature-verified auto-updates.
• Compliance-grade structured logging with defined retention windows for every event class.
• Multi-region redundancy with automatic point-in-time recovery.

Where we're going

Production launch is not the end state. Our horizon beyond it is a Sugarbug that any user can run entirely on their own machine. Your model, your storage, your graph, syncing nothing it does not have to.

Retention is yours to control

Sugarbug mirrors your source system's retention policy. If your Slack keeps messages for 90 days, Sugarbug's copy disappears on the same schedule. When you delete your account, we delete everything, vector embeddings included.

No locks on the door

We do not want to lock you in. We want you to stay because Sugarbug is genuinely the best experience and makes you and your team sharper than any alternative. That is why you can pull your data out at any moment, with no conversations with sales and no retention team standing between you and the export button.

Overbuilt for enterprise

Identity and access. SAML 2.0 SSO with Okta, Azure AD, Ping, Google Workspace, and JumpCloud. Org-enforced MFA policy, configurable session timeouts, and IP allow-listing at the organization level.

Data boundaries you can verify.

• Your data does not train models. This is an architectural commitment.
• Regional data residency in the US, EU, and UK.

Overbuilt for healthcare

• Business Associate Agreement available on every paid tier, signed before any Protected Health Information flows through your account.
• Minimum-necessary access controls, with PHI-aware audit logging retained for six years to meet HIPAA and HITECH requirements.

Compliance trajectory

At production launch, Sugarbug targets:

• SOC 2 Type II – security, availability, and confidentiality.
• ISO/IEC 27001 – international information security management.
• HIPAA for customers with Business Associate Agreements.
• GDPR – data portability, right-to-erasure, and lawful basis throughout.

Frequently Asked Questions

Does Sugarbug train AI models on my data?

No, and it never will. At production launch, Zero Data Retention is in place with every LLM provider we route through.

Can my employer read my private Slack DMs through Sugarbug?

No. Sugarbug scrapes with your permissions only.

What happens to my Sugarbug data when I leave my company?

You keep your private graph and walk out with it.

How does Sugarbug keep personal data out of AI prompts?

At production launch, PII is stripped from every enrichment payload before the model ever sees it.

Is Sugarbug SOC 2 and HIPAA compliant?

At production launch, Sugarbug targets SOC 2, ISO/IEC 27001, HIPAA (with BAAs), and GDPR.