Security posture, in plain terms.

• Indexed content: messages, documents and notes from the sources you connect. Indexed content lives in your dedicated workspace and is used only to answer queries from members of that workspace.
• Query logs: the question, the sources cited and the user who asked - retained for 90 days by default, configurable up to 24 months on Enterprise, or shorter on request.
• Training: your indexed content is not used to train shared or foundation models. Retrieval and ranking are workspace-scoped.

• In transit: TLS 1.2 or higher on all endpoints, including connector traffic and web app requests.
• At rest: AES-256 for indexed content and query logs. Object storage and databases are encrypted with per-workspace key material.
• Key management: managed keys by default; customer-managed keys available on Enterprise engagements.

Every answer is scoped to what the asking user could open in the native source today. If a Drive folder or a Slack channel is not accessible to them, its content cannot appear in an answer - not as text, not as a citation, not as a hint.

• SSO on SAML or OIDC (Enterprise) or Google Workspace / Microsoft 365 identity (Growth)
• Per-source permission checks on every query, not cached across sessions
• Excluded sources never enter the index in the first place
• Workspace admin actions are logged with a reason

• Hosting: production is hosted on major cloud providers with hardened infrastructure baselines.
• Regions: primary hosting in AP-South and EU-West. Regional residency for indexed content is available on Enterprise.
• Backups: daily encrypted backups with 30-day retention. Restores tested on a rolling schedule.

Goplustive is stated at current status only. We publish what is in place today and what is planned - no aspirational badges.

In the event of a confirmed security incident that materially affects your workspace, we notify workspace admins within 72 hours with the details we have, a working hypothesis, and a follow-up cadence until it is closed out. Root-cause and remediation notes are shared once available.