Security

1. Encryption

Data is encrypted in transit using TLS. Customer content and account data are stored encrypted at rest (AES-256) by our database provider.

2. Access to your content

• Your account is kept separate from every other account. Your content is reachable only through your own account.
• Credentials you connect, such as CMS tokens, are stored encrypted and are never shown back through our service.
• You can withdraw any access you granted at any time, from your cpywrk settings or on the connected platform's side. Articles already published stay where they are.
• We log system activity so we can investigate and fix issues.
• We follow a written incident response process. Section 12 sets out what we tell you when an incident affects your data.

3. Your content and AI models

We do not use your inputs or outputs to train AI models. Your content is processed by our AI provider only to serve your requests. Our AI provider's commercial terms do not allow it to train models on customer content. Article images are produced by a separate image generation provider.

Corrections you make improve your own brand profile and nobody else's.

4. Payment data

Card details are handled by our payment provider and are never stored on cpywrk systems. We keep only billing details such as your plan and payment status, and nothing that could be used to take a payment.

5. Sub-processors

We use a small number of carefully selected providers to run cpywrk, in these categories: hosting, database and file storage, sign-in, background processing, AI text generation, AI image generation, email delivery, payments, search and analytics reporting, caching, usage analytics, and cookie consent management.

Each provider is reviewed before we engage it.

We notify customers at least 14 days before adding or replacing a sub-processor.

Customers and prospective customers can request the full list, with each provider's name, location and transfer safeguard, by emailing security@cpywrk.com.

We do not sell personal data and we do not share it with advertisers or data brokers.

6. Our providers' certifications

Our hosting, database, sign-in, background processing and AI providers hold independent security certifications such as SOC 2 Type II and ISO 27001. Our payment provider is PCI DSS Level 1 certified. For details, email security@cpywrk.com.

cpywrk does not hold a security certification of its own. If your review needs one, ask us before you buy.

7. International transfers

Some of our providers operate outside the European Economic Area. The full sub-processor list, available on request, states the transfer safeguard for each provider.

8. Retention and deletion

We keep account and content data while your account is active. When you close your account or your subscription ends, we keep your data so you can export it, and we delete it when you ask us to, at privacy@cpywrk.com. Anonymised usage totals may be kept for longer for statistical purposes.

Billing records are kept for 7 years, as accounting rules require. That obligation overrides a deletion request, so those records remain after an account is deleted.

9. Your controls

You can export your content and request deletion of your data at any time. Your other rights under the GDPR are set out in section 9 of the Privacy Policy, and you can exercise them at privacy@cpywrk.com.

10. Data processing agreement

For the content and data you put into the platform, we (SharpWitted, registered in Copenhagen, Denmark, CVR 46659325, trading as cpywrk) act as processor: we handle it on your instructions and for no other purpose. A DPA is available on request. Its sub-processor annex names the providers engaged for your account, drawn from the sub-processor list available on request. Write to legal@cpywrk.com.

11. Reporting a vulnerability

If you believe you have found a security issue, write to security@cpywrk.com with enough detail to reproduce it. We will acknowledge your report and work with you on a fix. Please do not test against other customers' accounts or data, and please give us reasonable time before disclosing publicly. We do not offer rewards, but we are happy to credit you in the fix note.

12. Incidents

cpywrk is the data controller for the personal data described in the Privacy Policy, such as account, billing and usage data, and processor for the content you supply (section 10). Where a personal data breach occurs in data we control, we notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and we notify affected individuals where the risk to them is high. Where an incident affects content we process for you, we tell you without undue delay so that you can meet your own obligations. In either case we tell affected customers what happened, what data was involved, and what we have done about it.

13. Contact

Security questions and vulnerability reports: security@cpywrk.com. DPA requests: legal@cpywrk.com. Privacy requests: privacy@cpywrk.com.

14. Availability

Service availability is covered in section 11 of the Terms of Service.

15. Changes to this page

Agreements may refer to this page as it stood on a given date, so each revision is listed here.

• October 17, 2026. Page restructured and shortened. Security measures restated at the level of outcomes. Encryption at rest attributed to our database provider. No-training commitment restated with our AI provider's commercial terms. Sub-processor list and provider certifications now available on request. cpywrk's own certification status stated. Security contact address added. Cross-references to the Privacy Policy corrected. Sections renumbered.
• September 22, 2026. Sub-processor list restated with legal entity, data location and transfer basis, in two groups. Provider locations and legal entities corrected. Reporting access added as its own row. New section on access to your content. Notice period for sub-processor changes stated. Processor role stated. Retention reworded to say deletion after closure happens on request, replacing a 60-day automatic deletion that was not in place. Written incident response procedure stated. Privacy Policy scope extended to the audit tool at audit.cpywrk.com. Contracting entity named.
• September 21, 2026. Sub-processor list completed: remaining providers added.
• August 28, 2026. Page published.