Security

Version 2026-10-05.1. Last updated 5 October 2026.

Medley protects booking agencies' communications and business records through access controls, secure infrastructure and defined handling procedures. This page summarises the security commitments for the early-access service. The Data Processing Agreement contains the associated contractual measures.

Access and confidentiality

Access requires authentication and is controlled by organisation, user and role. Business records can be shared within an agency according to its permissions; private mailbox bodies and AI conversations are subject to user-level restrictions. Customer workspace data is not exposed to other customer organisations through workspace access or the shared directory. Customer-directed sending and sharing remain available to recipients the customer chooses.

Staff access is limited to named authorised personnel who need it for an approved purpose and are bound by confidentiality. Privileged access requires multi-factor authentication. Access to private content is recorded and removed when no longer needed. An internal concierge account does not automatically grant access to private mailboxes, chats or diagnostic traces.

Encryption and credentials

Data uses supported encrypted transport connections. Managed primary databases and file stores use encryption at rest. Credentials and secrets are protected from client exposure and routine logs. Connected-mailbox permissions are limited to the authorised functionality, and disconnection revokes credentials controlled by Medley.

These measures are not a claim of end-to-end encryption: authorised service processing needs access to content to provide features such as search and AI assistance.

AI and diagnostic information

AI processors receive the information needed for the service under appropriate contractual and access controls. Customer content is not provided for an AI vendor's own general-purpose training by default. Manual, assisted and automated actions operate within customer instructions, authorised functionality and applicable permissions. Authorised settings or instructions may cover ongoing actions without individual confirmation of each action.

Routine operational logs are designed to exclude raw email bodies, passwords and tokens. Content-bearing AI traces and support examples have separate purpose, access and retention controls. Human review follows the documented authorisation and source-specific rules in the DPA; a general rating does not grant access to an entire conversation.

The shared business directory contains independently researched public facts. Private research inputs, booking terms and customer relationship history remain outside those shared profiles.

Infrastructure and service providers

Medley uses managed infrastructure and the providers described on the Subprocessors page. Hosting providers manage physical facilities under their agreements; Medley remains responsible for its application configuration and processor obligations.

We assess data locations and access arrangements by service. An EU hosting location alone is not a claim that all ancillary processing or support access occurs in the EU. Appropriate transfer safeguards are required where applicable.

Government requests and international access

Medley assesses government requests for data against the applicable law, the requesting authority’s powers and the scope and validity of the request. A foreign request alone is not sufficient authority for a disclosure that conflicts with applicable EU or Member State law. We seek clarification, narrow or challenge requests where required, restrict any lawful disclosure to the required information, and inform the affected customer where legally permitted and required by the applicable agreement or law.

We use proportionate technical, organisational and contractual safeguards to prevent unlawful international government access or transfers, including for non-personal data held in the EU. These include access restrictions, encrypted transport and storage, vendor safeguards and review of requests before disclosure. This is not a representation that every foreign request can be resisted or that data is immune from lawful access. The DPA and applicable transfer terms govern personal-data disclosures.

Operations, backup and recovery

We maintain controlled deployment access, dependency/security updates, monitoring and incident-handling procedures. Backups are protected from unauthorised access, with proportionate restoration testing and evaluation of access controls. We assess and address vulnerabilities according to their risk and impact.

Billing cancellation, mailbox disconnection and workspace deletion are distinct operations. During archive, ordinary active-service processing and scheduled sending stop; necessary security, storage/retention, billing and customer-requested recovery or exit handling may continue. Deletion procedures cover live data, controlled downstream copies and backup expiry; restored systems must not reintroduce data subject to an outstanding deletion instruction. Retention periods are described in the Privacy Notice and DPA.

Data export

This is the export-format register referred to in section 11 of the Early Access Agreement. Medley prepares an export on request to hello@medley.fm and delivers it as a secure download: structured records as JSON files, one per record type, linked by identifiers; uploaded files and stored attachments in their original formats; and stored emails with their headers, body and attachments. Documentation of the fields accompanies each export.

Security incidents and reports

Report suspected security issues to hello@medley.fm. Include enough information for investigation without sending unnecessary private content, passwords or access tokens. Please arrange a secure transfer with us if sensitive evidence is needed.

For an incident covered by the DPA, Medley notifies the affected agency without undue delay and no later than 72 hours after awareness, with further information as it becomes available. This outer limit is not a reason to delay an earlier feasible notification. The DPA describes assistance, containment and audit arrangements.

Assurance and changes

Medley does not represent that it holds SOC 2 or ISO certification, operates a regular independent audit programme, or provides a contractual uptime SLA unless separately agreed. Relevant available security information can be supplied confidentially under the DPA's assurance procedure.

We review and update safeguards as the service develops without materially reducing the agreed protection. No security measure can remove every risk; the service's contractual commitments and applicable legal obligations remain in force.