Your account has a Private area, and it can have one always-on space. They differ in one thing: who can open them while you are signed out.

Your account key is made on your device. We keep no copy of it and no escrow. While you are signed out, our servers cannot open your account — except an always-on space, if you switch one on. This describes an account with encryption set up. For that one space our servers keep a wrapped key, so they can open it to run your automations while you are away. Each opening goes through a separate key service and is written to the space’s access log, which you can read in Settings. Switch the space off and no new opening is possible. Our key for it is then destroyed, and the app shows this until it is done. The content stays in your account, closed to us while you are signed out.

Workflow data created before our October 2026 custody change moves under your own key the next time you sign in; until then our servers can still open it.

Availability. Always-on spaces are off by default and are being rolled out. If you do not see Settings → Always-on space, they are not on for your account yet.

Which to use

	Private	Always-on space
Who can open it while you are signed out	Nobody, apart from the older workflow data in the note above	Our servers, through the key service, to run your automations
Every opening recorded	—	Yes, in the space’s access log
Automations run while you are away	No. A scheduled run waits until you are back	Yes, for workflows bound to the space
Can read the other side	—	No. A space automation reads only the space
Default	Everything you create	Only what you move in

Use Private for everything that does not need to work without you. Use the always-on space for the few things that must: a workflow that answers a webhook at night, and the notes, documents and credentials it needs to do that.

What the always-on space is, and is not

It is one workspace you own alone, separate from your Private area. You switch it on, you decide what goes in, and you can switch it off.

It is not a weaker copy of your whole account. Nothing moves into it unless you move it. Our servers cannot use the space’s key to open your Private area. It is not shared with other people.

When you switch it on, the app shows you what changes and asks you to acknowledge it. We record that acknowledgement together with the version of the text you saw.

What can go in

Notes and tasks move in as records you can keep editing.
Documents and research move in as snapshots.
Connector credentials, so a space automation can use a connection.
Workflows are not moved. You bind a workflow to the space, and it then runs there.

Tables cannot go in. Moving something in is a move, not a copy: it leaves your Private area. You can move it back out to Private.

What a space automation can do

A workflow bound to the space runs inside the space. Before each run, every step is checked against a list of steps allowed there, and a step not on the list stops the run. The allowed steps are:

conditions, delays and approvals;
calls to the model;
reading notes and note templates in the space, and searching documents in the space;
API calls and connector steps;
a bridge request to you (below), and a sealed deposit into your Private area (below).

API calls and connector steps can send data out of the space, so what leaves is decided by the workflow you build. Approvals and the send rules in Unattended Actions and Approvals still apply.

From outside the space, an automation reads only its trigger’s payload — for example, the body of a webhook that started it. Your mail inbox is not an input to the space.

The bridge out: asking you

A space automation cannot read your Private area. When it needs something from you, it sends a bridge request:

The automation sends the fixed holding reply set in the workflow, and pauses.
The request appears in your Needs you list. What we store outside the space about it holds no content.
You open the request while signed in, and you release it, answer it, or decline it.
If you do nothing before the request expires, the automation sends the workflow’s fallback reply.

When you release, the automation sends only the reply you approved, exactly as you saw it. The automation then continues after that send. Each release is written to the access log. Resolved bridge requests are kept for 90 days.

The bridge in: deposits to Private

A space automation can also hand something to you. It seals the item to a key that only your Private area holds, and the item is opened the next time you sign in. A deposit that is not opened within 30 days expires and is lost.

The access log

Every opening of the space is written to its access log in Settings → Always-on space. The log shows which automation or connection opened the space and when, and each bridge crossing. It is kept for 12 months and is part of your data export. Settings also tells you if the log is missing an opening that the key service recorded.

If a court comes asking. A court can order us to open an always-on space. While you are signed out, the rest of your encrypted account’s content is closed to us: we hold no key to it, apart from older workflow data that has not yet moved under your own key (see the note at the top). If we are ever made to open a space, we record it in that space’s access log, unless the law forbids us to.

Switching off

Switch the space off in Settings → Always-on space. From that moment no new opening is possible. Our key for the space is then destroyed. The app shows “our key is being destroyed” until that is confirmed, and you cannot switch a new space on while it is pending. The content stays in your account, closed to us while you are signed out.

Deleting your account destroys the space’s key as part of the same erasure.

Plans and organisations

An always-on space comes with plans that include workflows: Standard, Plus, Max and Enterprise. It is not part of Minimum.

If you belong to an organisation, its admin can allow or deny always-on spaces. An admin can never switch one on for you.

What is not available

Snapshots and legal hold of the space.
Shared always-on spaces. A space has one owner.

Glossary

Private — your account outside the always-on space. Closed to us while you are signed out, apart from the older workflow data in the note at the top.
Always-on space — one workspace you choose to switch on, which our servers can open to run your automations while you are away. Every opening is logged.
Bridge — the way a space automation asks you for something. You release, answer or decline it.
Deposit — an item a space automation seals for your Private area. It opens when you next sign in.

How Your Data Is Protected — the encryption model for your Private area.
Setting Up Your Encryption — devices, rotation and recovery.
Unattended Actions and Approvals — when an automation may contact the outside world.