Where your data sits
Belda and your data run in Frankfurt, inside the European Union. One thing runs outside it today. The model that reads and writes for the agent runs on its vendor’s global route, which may serve a call from the US, with a second vendor’s standard endpoint as the fallback on an outage. The backup copies of the database sit in a bucket pinned to the same region. Every deploy of new code is preceded by a backup restored to a throwaway database and read back before the deploy goes ahead.
Every workspace is kept separate
Every row of your data belongs to your workspace. The database refuses a read across workspaces on every table, and it refuses our own application account the same way. A request that names a workspace without a signed key is refused before it reaches any data. Belda measures which screens are opened and which buttons are clicked, as anonymous IDs only, on its own EU project, until you switch that off; nothing typed and no prospect ever leaves the browser. Belda learns from what worked across the workspaces that take part, and yours takes part only when you switch that on. Information received through Google APIs is never part of this, in any form, aggregated or derived.
That fence stands on every table Belda's code defines, 375 of 375 on 13 October 2026, and a test proves it before any change to the code lands. Source: belda-app api/tests/test_rls_isolation.py over Base.metadata.tables at origin/main ca72bb21b22.
As of 13 October 2026Your tokens are sealed
Belda keeps the consent for your mailbox and never a copy of your mail. Of your mail it keeps only the replies to the threads it wrote in. The permissions it holds are listed in your settings in plain words, and you can revoke them in your own admin center.
What it may do, and what it never doesEmails go out from your own mailbox
Every email is written from the person whose name is on it, in that person’s mailbox, and the only address it can go out from is theirs. There is no rented domain and no shared sender.
Drafts before sends
Every workspace starts in Drafts: every email lands in the seller’s Drafts folder and nothing goes out until a person clicks send there. Moving beyond Drafts is a setting, and only a person changes it. It never changes on its own.
The model writes. Code sends.
The AI reads, writes and drafts. It cannot send. Every draft passes four automatic checks before a prospect sees it: every quote is matched to the company’s own website; any claim outside your approved list is removed; your sending rules are applied, with a log of what was allowed, what was stopped and why; and each meeting time is held the moment it is offered, so nobody is double-booked. The log sits in your workspace for you to read.
Every email is checked first
Nothing goes out until the check has run. Everyone who joins starts with the agent asking before each email, one by one.
One click stops everything
There is one stop button and it stops the whole workspace. Today it covers email and calendar. It does not yet reach LinkedIn and WhatsApp, which run in your own browser, and the button says so on itself rather than letting you find out later.
What you controlWhat the agent reads, and what it writes
The agent reads the mailbox and the calendar you connected, and writes from the person whose name is on the email. When you bring your old CRM across, the connection reads once and writes nothing back, not even a field name. You approve the field map before anything is imported, so the boards you do not want in Belda are left out by you rather than found later.
Your rules, market by market, with the reason for each
We do not tell you what is legal where you sell, and we never will. Every market gets its own settings: the language, whether you write to named people and why, how many follow-ups, the hours you send in, the footer. We show you what we suggest and the reason for it. You decide.
Your data leaves as easily as it arrives
Everything the agent found carries its source and the date, and every count comes with the number it was counted out of. What your team builds up in Belda leaves with your team.
Ask us the hard question.
Write to hussam@belda.ai. You get the founder's answer, in writing, and you can hold us to it.