Security

Last updated: 4 May 2026

This page describes how Importify Limited ("Lilie") protects your data. We take security seriously and have built Lilie to minimize the surface area where your data could be exposed.

For details on what data we collect and how we use it, see our Privacy Policy.

Our security philosophy

The most secure data is data we don't have. Lilie is designed around three principles:

1. Minimize what we retain. Where possible, we extract structured derivatives (voice profiles, embeddings) and discard the original content.
2. Scope access tightly. All data is scoped to the user account that owns it. There is no shared data between users.
3. Be honest about what we do. This page describes our actual practices, not aspirations. If something changes, this page changes.

Data protection

Encryption in transit

All connections to and from Lilie use HTTPS/TLS. This includes:

• The Lilie web application at lilie.app
• The Lilie Chrome extension
• All API endpoints
• All connections to subprocessors (Google, OpenAI, Supabase)

We do not accept connections over unencrypted HTTP.

Encryption at rest

Your data is encrypted at rest in our databases:

• Supabase (PostgreSQL) — AES-256 encryption at the storage layer (managed by AWS)
• Backups — encrypted using the same standard

Authentication

• Lilie uses Google Sign-In (OAuth 2.0) for user authentication
• We do not store passwords (Google handles authentication on their side)
• Sessions are managed via short-lived JWT bearer tokens, not cookies
• Tokens are stored in your browser's local storage on your device only

Access controls

• Production database access is limited to a small number of authorized personnel
• All production access is logged
• We use the principle of least privilege — services only have the minimum permissions they need

How your data is isolated

Per-user scoping

Every record in our database is tied to a specific user_id. All queries automatically filter by the authenticated user's ID. There is no cross-user data sharing.

This includes:

• Voice profiles
• Knowledge base entries (documents, chunks, embeddings)
• Generated drafts
• Connected Gmail accounts
• All settings and preferences

Row-level security

Our database uses Supabase's row-level security (RLS) policies to enforce user scoping at the database level. Even if an application-layer bug were to attempt a cross-user query, the database would reject it.

No training on user data

We do not use your data to train any machine learning model that is shared between Lilie users. Specifically:

• We do not fine-tune any model on user voice profiles, knowledge bases, or drafts
• We do not include user data in training corpora
• OpenAI, our LLM provider, does not use API inputs to train their models (per OpenAI's API data usage policy)

What we don't store

To minimize attack surface, we deliberately avoid storing:

• Passwords — authentication is handled by Google
• Raw email bodies — we extract structured derivatives and discard the originals
• Email content in logs — error logs contain metadata only, never email bodies
• Payment information — Lilie is currently free during beta; when paid plans launch, payments will be handled by a PCI-compliant processor and we will not store card details
• IP addresses long-term — collected for usage data but anonymized after 24 months

Subprocessors and supply chain

We use a small number of trusted subprocessors. Each is contractually obligated to maintain security standards equivalent to ours and to handle your data only for the purpose of providing their service.

For the current list, see lilie.app/subprocessors.

We monitor security advisories for our dependencies and apply patches in a timely manner.

Vulnerability disclosure

If you discover a security vulnerability in Lilie, please report it to support@lilie.app with the subject line "Security: [brief description]".

We commit to:

• Acknowledging your report within 3 business days
• Investigating and responding to legitimate reports within 14 days
• Crediting you in our disclosure (if you wish) once the issue is resolved
• Not taking legal action against good-faith security research

Please give us reasonable time to address the issue before public disclosure.

Incident response

If we discover a security incident that affects your data, we will:

1. Investigate and contain the incident
2. Notify affected users by email
3. Notify relevant authorities as required by applicable law (generally within 72 hours of becoming aware of a breach involving personal data)
4. Publish a post-incident summary describing what happened, what was affected, and what we've changed to prevent recurrence

Compliance and certifications

Lilie is currently in private beta. We have designed our practices to align with:

• GDPR for users in the European Economic Area and United Kingdom
• CCPA for California residents
• PDPO (Hong Kong's Personal Data Privacy Ordinance) as our primary jurisdiction

We do not currently hold formal third-party security certifications (e.g. SOC 2, ISO 27001). We will pursue these as the company scales and customer demand warrants.

Your security responsibilities

Security is a shared responsibility. To keep your account safe:

• Protect your Google account — use a strong password and enable two-factor authentication
• Review connected apps at myaccount.google.com/permissions periodically
• Don't share your account — Lilie is intended for individual use
• Keep your browser updated — security patches matter
• Report anything suspicious to support@lilie.app

Contact

For security questions, vulnerability reports, or compliance inquiries:

Importify Limited Unit 1603, 16th Floor, The L. Plaza 367–375 Queen's Road Central Sheung Wan, Hong Kong

Email: support@lilie.app