Our ducks have it covered.
You are trusting Duckrow with your mailboxes, your LinkedIn accounts and your leads. Here is exactly how we look after them, in plain words.
Your data stays in your workspace
Every table, campaign and conversation belongs to one workspace, and the database itself enforces that. One customer can never read another's rows.
Two-step login
Turn on two-step verification for your login, so a stolen password alone isn't enough.
Gmail and Outlook: what we ask for, and what we use
Duckrow asks Google or Microsoft for permission to send email for you and to read your mailbox, because that is how it sees replies. It looks at new inbox mail only to find replies to threads Duckrow started, keeps a short preview of each reply, and stores nothing from the rest of your mail.
Disconnect means disconnected
Disconnect a mailbox and Duckrow cancels its access with Google or Microsoft before deleting the connection, so nothing is left behind.
Encrypted, stored and in transit
Every connection uses HTTPS, and our database host encrypts everything it stores. Mailbox sign-ins Duckrow keeps, API secrets and your AI keys get a second layer of encryption from Duckrow itself, and a saved AI key is shown only by its last four characters. Gmail and Outlook mailboxes connected through Composio keep their sign-in with Composio, so Duckrow stores none for them. The software Duckrow runs on is scanned for known vulnerabilities, and fixes ship as they are found.
The right access for every teammate
Every workspace has four roles. Owners handle billing, admins manage people and settings, members build and send, and viewers can look without changing anything or spending credits.
Texting by the rules
Texts go out from numbers Duckrow provides and registers, carry STOP instructions on every automated text, and a STOP reply opts the lead out before the next send.
Business outreach only
Duckrow is built for reaching businesses and the people who run them. Please keep patient health information out of your workspace: we don't sign HIPAA business associate agreements today.
Google's security assessment
Apps that read Gmail must pass Google's Cloud Application Security Assessment (CASA), an independent review of how the app protects your data. The Google connection Duckrow will use is going through it now. Until then, Gmail connects through Composio.
Gmail and Outlook, connected through Composio
For now, Duckrow connects Gmail and Outlook through Composio, a separate company that handles the sign-in with Google and Microsoft. When you connect, Google's or Microsoft's screen will ask you to allow Composio. That is expected.
The privacy laws we work under
Duckrow is an Alberta company. We handle personal information under Alberta's Personal Information Protection Act and Canada's PIPEDA. Our emails and texting follow Canada's Anti-Spam Legislation: every campaign email carries an unsubscribe link, and every text honours STOP and ARRET. Questions go to our privacy officer, Shahrukh, at hello@duckrow.ai.
Your ducks are ready when you are.
