Security & data practices

NextShot doesn’t use your data to train any AI model. The AI that researches accounts and drafts messages runs on Anthropic’s Claude models under Anthropic’s commercial API terms, which also don’t allow your data to be used for training.

Every request is checked against who is signed in, and every record is scoped to its owner and team, so one customer can never see or change another’s data. Within a team, the owner and admins manage the workspace; members use it.

• Sign-in is handled by Clerk, a dedicated authentication provider. NextShot never sees or stores your password.
• Teams have three roles: owner (billing and ownership), admins (members and shared settings), and members.
• Team invites are one-time links that only work for the invited email address and expire after 7 days.
• Admin actions such as invites, removals, role changes, ownership transfers and data exports are recorded in an audit log.

• All traffic to NextShot is encrypted in transit (HTTPS, with HSTS).
• The database is encrypted at rest by our database provider, Neon.
• Connection keys for Gmail, HubSpot and Apollo get a second layer: they’re encrypted with AES-256-GCM before they’re stored.
• Card payments go straight to Stripe. NextShot never sees or stores card numbers.

• Rate limits on every AI feature and sensitive action, to stop abuse and runaway costs.
• Security headers on every page, and safeguards that stop the server from being tricked into fetching internal addresses.
• Text pulled from the web is treated as data, never as instructions to the AI.
• Gmail access is limited to drafting and sending the messages you approve, reading your signatures, and tracking sends and replies by message details. NextShot doesn’t read the body of emails in your inbox.

• Export your accounts, contacts, deals and messages as CSV any time (Settings → Data & privacy). Team owners and admins can export the whole team.
• Deleting your account cancels your plan and erases your workspace data. Database backups are kept for a limited window for disaster recovery and age out automatically.
• A team-wide do-not-contact list, and a record of where each contact was found.

NextShot uses these service providers (subprocessors):

• Anthropic, AI generation and web search
• Findymail, finding and verifying work email addresses
• Neon, database hosting
• Vercel, application hosting
• Cloudflare, DNS and network security
• Clerk, authentication and account management
• Stripe, payment processing
• Resend, transactional email
• Trigger.dev, background job processing
• Sentry, error monitoring
• Google, Gmail integration, only if you connect it
• Apollo, email lookup, only if you connect your own Apollo account

NextShot doesn’t have a SOC 2 report yet. If your company needs a security questionnaire completed or a data processing agreement, email hello@nextshotai.org.

Found a vulnerability? Email hello@nextshotai.org with the details. We’ll respond quickly and won’t take action against good-faith research.