Your data locked down

How we protect your data

It belongs to your business and is kept apart from everyone else's.

Every business lives isolated from the others, and the database enforces it on top of the code: a badly written query can't show another business's data.
Your Mercado Libre and Tiendanube credentials are stored encrypted and never reach the browser or the AI model.
Howe doesn't train models on your business data.
We keep only what's needed: from Tiendanube we don't store anything about your buyers.
If you ask to close your organization, its data is deleted. All that stays in the audit log is what doesn't identify anyone.
A backup is made every night, encrypted and kept off the server.

To learn how your business data is handled, write to us at hola@howe.com.ar.

Everyone sees and does only what's theirs to do.

Every member has a role, from whoever manages everything to whoever can only look, and permissions are checked on the server, not on the screen.
No change reaches your channels without going through the change engine: the agent proposes and you approve from the web, your phone or WhatsApp.
You choose how far it acts on its own. A price that would lose you money is never applied automatically, in any mode.
Every change keeps how things were before: one click and it's back.
Who changed what and when is logged, in a record nobody can rewrite.
Signing in takes a password of at least 12 characters, failed attempts are limited and sessions expire.

See how every change gets approved on the Agent page.

OWASP Top 10 and ASVS 5.0, level 2
They are the security baseline for the application: authentication, sessions, access control, input validation and error handling. Every finding from a review is reported with its OWASP code.
OWASP for AI and agents
For the agent we follow the OWASP Top 10 for LLM applications and for agentic applications: everything the model reads is data, not instructions, and on your channels the only thing the agent can do is propose changes.
Argentina's Personal Data Protection Law 25.326
It's our reference for which personal data we keep, what for, and how it gets deleted. When Tiendanube says a customer's data has to be deleted or handed over, Howe processes it.
Platform requirements
We connect the way each platform asks: OAuth authorizations, official APIs and notifications that are verified before they are read. We follow the privacy requirements of Tiendanube and Meta.
Review and testing
Every change that touches access, a business's data, notifications, credentials or what the model reads goes through a security review before it lands. And automated tests check that one business can't use another's data.

Defense in depth
Every layer assumes the one before it can fail. The code filters by business and the database enforces it again, permissions are checked on the server and processes run with a database user without administrator privileges. The app reaches the internet through a Cloudflare tunnel, with no open ports on our servers. See how Howe works.
The agent only proposes
The agent's write tools only add changes to a list that you approve. What it reads (supplier lists, messages, descriptions) is data and never instructions, and every step is recorded. Cost jumps are never applied automatically. Meet the agent.
Controls for your team
Roles with permissions checked on the server, an audit log nobody can rewrite, approvals that expire if nobody handles them, and an AI usage cap per plan so a mistake doesn't turn into a surprise. See the plans.
Reporting a security issue
If you find a flaw or something that doesn't add up, write to us with what you saw and how to reproduce it. Test only with your own account and without accessing anyone else's data. hola@howe.com.ar.