Trust
What is true today, in writing
Most trust pages are a wall of logos. This one is two columns: the controls our code and our paperwork actually back, and the ones we have not built yet. We would rather you find the second column here than in month three.
Last reviewed September 9, 2026
True today
Backed by code, a contract, or a public record
The AI provider is named by feature
Qwen 3.8 Max designs and refines websites through Vercel AI Gateway, with zero-data-retention routing required on every request. Gemini remains limited to the storefront assistant, logo prompts, and content tools. Saved website projects live in the United States Firebase database; model processing is transient, but we do not call the provider network US-only.
Vercel AI Gateway, Qwen providers, and Google Gemini are listed on /trust/subprocessors; website routing is enforced in lib/qwen-website.ts.
The database denies by default, and the client cannot grant itself anything
Firestore rules start from deny-all: a collection with no rule is readable by nobody. Records are owner-scoped, so one customer cannot read another's. The fields that decide what you have paid for — plan, subscription state, credits, roles — are writable only by the server after Stripe confirms payment.
Enforced in firestore.rules, deployed with the application.
Managed customers' data stays in their own Microsoft 365 tenant
For Solutions customers, mail, files, calendars, and SharePoint content live in your tenant, in your name, under your billing. Automations read and write there through Microsoft Graph, under a consent your own admin grants in your admin center and can withdraw at any time. We do not copy your content into a store of ours to make a workflow run.
See the Microsoft security detail for scopes, revocation, and data locations.
A real company, at a real address
IMPRESSIONSDIRECT360 LLC is a Missouri limited liability company operating from 701 Market St Ste 110 #2008, Saint Louis, MO 63101-1824. Support is answered by the people who build the product, on the phone number and address published below.
+1 (314) 339-4936 · support@impressionsdirect360.com · Monday–Friday, 9:00 AM – 6:00 PM Central
Stripe handles card data — we never see it
Card details are entered directly into Stripe's hosted fields and never reach our servers. What we store is a customer token, the last four digits, and subscription state. There is no card number in our database to lose.
All billing runs through Stripe Checkout and the Stripe webhook.
On the roadmap
Decided, not delivered — do not buy on these
A formal third-party audit
We have not been audited by anyone, and we hold no security certification. When we engage an auditor we will say who, for what scope, and when the report is expected — and we will not describe the engagement as a certification until a report exists.
Not started.
Published uptime monitoring
Our plans state an automation uptime target, not a contractual guarantee, because we do not yet run the external monitoring that would back one. The next step is a public status history that you can check without asking us.
Targets are stated as targets everywhere on the site until this exists.
A per-client audit-log interface
We record what automations do, but there is no self-service screen where you can browse your own audit trail yet. Today you ask us and we send it. A customer-facing view is planned.
Available on request; no UI yet.
Tooling around the Microsoft access you grant
Today your Microsoft 365 admin consents to a named ID360 application from inside your own admin center. Its permissions are tenant-wide, not confined to the mailboxes and sites you nominate; pointing the automations at only those is our configuration choice, not a boundary Microsoft enforces. That consent has no expiry date — it ends when you withdraw it, and our access stops immediately. If our reseller enrolment with Microsoft completes we would move to granular delegated admin (GDAP), which adds scoped roles with a hard expiry; that is not how we work today. Either way, we have not built software that manages, reviews, or reports on those relationships; Microsoft's admin center is the system of record, and yours to control.
A working practice, not a product feature.
What we do not claim
We hold no security certifications
If a control below matters to your purchase, we are not the right fit today and we will tell you that on the first call rather than in a procurement questionnaire six weeks later.
- SOC 2 (Type I or Type II)
- ISO 27001 or any ISO certification
- HIPAA compliance or a signed BAA
- PCI DSS certification of our own systems
- Any Microsoft Solutions Partner designation
The detail behind each of these
Subprocessors
Every vendor that can touch customer data, what they do, what reaches them, and where they process it.
View the listIncident response
How to reach us, what we do in the first hours, and what we commit to telling you.
Read the commitmentMicrosoft 365 security
Graph scopes, the access you consent to and how you revoke it, tenant isolation, and where each kind of data lives.
See the Microsoft detailHave a security question we have not answered?
Send it over. If the answer is “not yet”, that is the answer you will get.