Answers to the questions security and IT teams ask most when evaluating Songbird. For how Songbird keeps each loop in bounds, see How Songbird loops are safer by design.
Infrastructure
Where is my data hosted?
Where is my data hosted?
In the United States. All stored data resides in USA-based data centers. Songbird plans to add other regions to meet regional data requirements in the future.
Is my data encrypted?
Is my data encrypted?
Yes. All data is encrypted in transit (TLS 1.2/1.3) and at rest (AES-256).
AI and data handling
Which AI models does Songbird use?
Which AI models does Songbird use?
Songbird uses Anthropic and OpenAI models. These may change as the frontier labs release better models. All model requests travel over encrypted API connections (HTTPS/TLS 1.2+).
Do AI providers train on my data?
Do AI providers train on my data?
No. Songbird uses Anthropic’s commercial API, and Anthropic documents that it does not train on customer data from its commercial products. OpenAI likewise does not train its models on API data by default.
Does Songbird train on my data?
Does Songbird train on my data?
No. Songbird does not train or fine-tune AI models on your inputs or outputs, and does not use customer data to train its own models.
What data does Songbird store?
What data does Songbird store?
Songbird stores what it needs to build, run, and explain your loops: each loop’s instructions and versions, the history of its runs (including each step’s inputs, tool calls, and results), the events that triggered them, and your conversations with the Songbird agent.
Access and credentials
Who at Songbird can access my data?
Who at Songbird can access my data?
Access to production systems is restricted to a small set of authorized engineers using MFA-protected accounts. Application and access logs are retained for operational troubleshooting and security monitoring.
How are my connection credentials handled?
How are my connection credentials handled?
Connection credentials are managed through Vercel Connect. Songbird never sees or stores your passwords.
Who in my organization can use a connection?
Who in my organization can use a connection?
It depends on the connection. A personal connection only works in its owner’s own loops. A shared connection works in the loops of one space. Organization apps (Slack, GitHub, and Linear) work in any loop in your Organization. Only the person who added a connection can disconnect it. See Connections.
Can Songbird act with more access than I have?
Can Songbird act with more access than I have?
No. The Songbird agent acts with your access, whether you use it in the app, in Slack, or from Claude or ChatGPT. It can only edit loops you can edit and use connections you can use.
Compliance
Is Songbird SOC 2 compliant?
Is Songbird SOC 2 compliant?
Songbird is implementing the foundational controls required for SOC 2 Type II certification, including access controls, logging, monitoring, and secure development practices. Songbird formally began the SOC 2 process in spring 2026.
Where can I find Songbird's privacy policy and terms?
Where can I find Songbird's privacy policy and terms?
Read the Privacy Policy and the Terms of Service.