Docs Features
Security and privacy
How Tidy keeps each company's data separate, how AI agents act as you, and what stays human-approved.
Your company's data is walled off
Every company on Tidy is its own organization. Every record and file is tagged with your company, and the database itself only returns rows for the company of the person asking. Two companies on Tidy cannot see each other's bids, files, clients or people. Uploaded files are stored in a folder for your company, and storage rules enforce the same wall.
Inside a company, your team shares the business data (bids, clients, vendors) on purpose. Admins manage the team, billing and company settings. Workspaces are shared with their members.
Everything runs as the signed-in person
The app, the Tidy agent and any AI agent you connect all act as you, with your permissions. Tidy does not use a master key for everyday work. When you connect Claude or ChatGPT over MCP, you sign in on Tidy's own consent page and the agent gets a token tied to you. You can Disconnect it any time in Settings > Signed-in devices.
A person approves what goes out
- Agents cannot send email. Follow-ups, bid submissions, declines and RFI chasers are drafts until someone on your team sends them.
- Billing, team changes and company settings are human-only.
- Each agent action can be set to Allow, Ask or Block in Agent mode under Skills & Plugins > Settings.
Sign-in and sessions
- Email and password, or Google for your company's email domains.
- Admins can deactivate a person, which ends every session, or sign them out of all devices.
- You can see and end your own sessions in Settings.
Limits that stop abuse
Daily limits on email recipients, AI drafting and agent tokens apply on every plan. One email can go to at most 25 people. See Plans and limits.
AI providers
We use AI providers whose terms do not allow them to train their models on what you send. Error reports are scrubbed of personal data before they leave the app.
What Tidy does not have yet
Single sign-on (SAML), two-factor authentication, an admin audit log and a SOC 2 report are not available today. If you need one of these, talk to us.