For data connected to your workspace, you act as the data controller and Think Mesh acts as the data processor, processing information solely on your documented instructions.

We process content from connected sources (email, chat, documents, CRM/ERP records, meetings) to index, search, summarize, and generate answers and automations within your workspace.

Processing is limited to what's needed to deliver the features you've enabled — nothing is used to train models shared with other customers.

We use a small number of sub-processors for hosting, storage, and AI inference. Each is bound by contract to protect data to the same standard as this agreement, and an up-to-date list is available on request.

Where data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses, and offer regional data residency on Growth plans and above.

Encryption in transit and at rest, role-based access controls, audit logging, and regular security reviews. See our Security page for more detail.

On termination or disconnection of a data source, associated data is deleted from active systems within 30 days, subject to backup retention windows.