Security at Savvyy

How we protect what you keep in Savvyy.

Your contacts, notes and email are among the most personal things you will store in any app. Here is what protects them, with a source beside each claim so you can check it yourself.

Encryption TLS 1.3 On every connection to our servers. Rated A+ by Qualys SSL Labs. Sign-in Google & Apple Your password stays with them, and so does your two-step verification. Independent review CASA, yearly Approved by Google for Gmail and Calendar, reassessed every 12 months. AI Amazon Bedrock Model developers such as Anthropic and OpenAI never receive your data.

01 · Encryption

Every connection is encrypted.

The Savvyy website and apps reach our servers only over HTTPS, using TLS 1.3 or TLS 1.2, the current versions of the protocol that encrypts traffic on the web. Anyone watching the network in between, on public Wi-Fi for instance, sees only scrambled data.

Older versions with known weaknesses are switched off. Our servers also instruct your browser to refuse any unencrypted connection to savvyy.com, a setting called HSTS, renewed for a year with each visit.

Qualys SSL Labs, an independent testing service, grades the setup A+. Run the test yourself

app.savvyy.comProtocol support
  • TLS 1.3On
  • TLS 1.2On
  • TLS 1.1 and 1.0Off
  • SSL 3 and 2Off
  • HSTSBrowsers refuse unencrypted connections1 year
  • Forward secrecyPast traffic stays private even if a key leaks laterOn
A+ Qualys SSL Labs server testTested 12 October 2026

02 · Sign-in

Sign in with the account you already protect.

Choose Sign in with Google or Sign in with Apple, and you enter your password on Google's or Apple's own page, never on ours. Savvyy receives confirmation that it is you, along with your name and email address. Your password never reaches us, so there is none for us to store or lose.

Whatever you have set up to protect that account, such as two-step verification or a passkey, protects your way into Savvyy as well. Apple requires two-factor authentication on every account that uses Sign in with Apple.

The same link works in reverse: your Savvyy sign-in is only as strong as that account. If two-step verification is not on yet, here is how to turn it on for Google and for Apple.

Signing up with an email and password instead? Choose one you don't use anywhere else.

  1. 1You choose Google or AppleOn the Savvyy sign-in screen.
  2. 2You sign in on their pagePassword, two-step verification, passkey: Google or Apple checks all of it.
  3. Savvyy gets a confirmationYour name and email address. Never your password.

03 · Independent review

Approved by Google. Tested by an outside lab every year.

Before an app can read Gmail or Google Calendar on your behalf, Google reviews what it asks to access and why. Savvyy is approved for both.

Reading Gmail carries one more requirement: an independent security assessment called CASA, the Cloud Application Security Assessment. A lab authorized by the App Defense Alliance, an industry security group whose members include Google, Microsoft and Meta, tests the app against requirements drawn from OWASP's Application Security Verification Standard, a widely used benchmark for web applications. In Google's words, the assessment verifies that an app "can securely handle data and delete user data upon request."

Savvyy passed at Assurance Level 1 (AL1), the level Google assigned it. Google requires the full assessment again every 12 months for an app to keep its access.

Google's verification rules · About CASA

  1. Google OAuth verificationAccess to Gmail and Google Calendar approved
  2. CASA security assessmentBy a lab the App Defense Alliance authorizes · Assurance Level 1
  3. Letter of ValidationIssued once the app passes
  4. Every 12 months, againA complete reassessment, whether or not the app has changed

04 · AI

The companies that build the AI never see your data.

Savvyy's assistant runs on leading AI models through Amazon Bedrock, a service of Amazon Web Services (AWS). Bedrock runs its own copy of each model in accounts that AWS owns and operates. The model developers, such as Anthropic and OpenAI, have no access to those accounts, so your notes, your email and the assistant's drafts never reach them.

Amazon states that content sent through Bedrock is not used to improve the models and is not shared with any model provider, and that it is encrypted in transit.

Bedrock data protection · Bedrock FAQs

Your notes and email

What the assistant reads to suggest a follow-up or draft a message

Savvyy

Sends the request over an encrypted connection

Inside AWS

Amazon Bedrock

Runs the model on a copy AWS hosts and operates

Model developers

Anthropic, OpenAI and others: no access to your data

Report a concern

Noticed something unusual? Tell us in confidence.

An email that claims to be from Savvyy and asks for your password, a sign-in you don't recognize, a screen showing something that isn't yours, a weakness you have found in the app: write to our security address and it will be handled confidentially.

security@savvyy.com

It helps to include what you saw, when and where, a screenshot or link if you have one, and the steps that led to it. Please don't send passwords. For anything other than security, write to hey@savvyy.com.