Security and trust: you stay in control
Toby works on your brand, your website and your tools. Here is how we keep your data safe and make sure nothing goes out without you.
Approval by default
Agents prepare; you decide. Publishing, sending, creating or spending becomes a To approve card. Autopilot is off by default and only works when you enable it for both the company and a given agent, for safe actions such as drafts or X posts, never ads.
Pause, caps and a full log
One Pause button stops the whole team. Each company has a daily AI cost cap, checked on the server before every AI call. Every action is written to a log: who, what, when.
Encrypted tokens
Keys and tokens of the tools you connect are encrypted at rest with AES-256-GCM and never sent back to the browser, not even to you. Passwords are never stored in clear, only a salted hash.
Data isolated per company
Every request checks that you belong to the company you're acting on. Each company has its own Brand Brain, memory, connections and history; nothing is shared between companies.
Hosting
The database (Turso) and the server that runs background jobs (Hetzner) are in Germany. The application is hosted on Vercel. Calls to connected tools only go to public addresses on each tool's own domain.
AI that doesn't train on your data
Toby runs on Anthropic's Claude models through the API. Anthropic does not use data sent through its API to train its models. Meeting transcripts are not kept: only the marketing-relevant summary is.
Respect for platforms and people
No fake reviews, no fake accounts, no vote manipulation. Reddit replies disclose the affiliation, influencer and partner outreach is personal and written to follow anti-spam rules (CAN-SPAM, GDPR), AI videos are labeled where platforms require it.
The full privacy policy and terms of use, including the list of processors, retention and your rights, are on the app's legal page.
Read the privacy policy and termsFrequently asked questions
Can an agent publish something by mistake?
Not by default: every write action waits for your approval. If you turn on Autopilot for an agent, only actions classed as safe can run alone, and you can pause the whole team at any time.
Can Toby spend my ad budget?
No. Toby doesn't launch ads on its own and ad-related actions are never run on Autopilot.
Who can see my data?
Members of your company in Toby, and the processors that run the service (listed on the legal page) for the sole purpose of running it. We don't sell your data or use it for advertising.
How do I delete my data?
You can delete a company and all its data in Settings at any time. On request, your account and all its data are erased within 30 days, except legal billing records.
Does Toby use cookies?
The app uses a single essential cookie to keep you signed in. No advertising or analytics cookies.
Give your business a marketing team that knows what to do next
Create your account, paste your URL and get your growth audit, your Brand Brain and your first three recommendations, already prepared.
7-day free trial, then $99/month per company. Cancel anytime. Already have an account? Sign in