Security

One PDF

The pack for finance, IT and legal.

01Security overview
gists.Security overview · Beta

Who sees what, in plain words.

Who sees what

HR and named leaders see every team with 5 or more answers. Each manager sees only their own team. Employees see no team scores.

Nobody sees

  • Who answered what
  • Any result from fewer than 5 people
  • Names on who has or hasn't answered

For IT

AccessSign in with Slack, Google or an email code. Single sign-on (SAML or OIDC) for your company's domain. Access by role: HR admins, named leaders read-only, each manager their own team only.
Audit logEvery view of results is logged.
Data regionData is stored with Google Cloud in the United States. SCCs, UK Addendum and Swiss terms are in the DPA.
Breach noticeWe tell you within 72 hours of learning of a breach.
UptimeNo uptime commitment (SLA) during beta. Uptime checks and alerts run all day.
SOC 2SOC 2 in progress.
QuestionnaireHave a security questionnaire? Send it to support@gists.ai and a founder fills it in.

Each privacy default, in words: gists.ai/security

TakeOnePiece LLC · support@gists.aigists.ai/security
02DPA, signed by us
gists.DPA · Signed by us

Data Processing Agreement

Between TakeOnePiece LLC (processor) and the customer below (controller). Includes the Standard Contractual Clauses, the UK Addendum and Swiss terms.

Your company agreed results are never used to judge or rate anyone.

The customer agrees to

  • use results only for groups of 5 or more;
  • never use results, or any answer, to judge, rank, discipline or decide about one person, including pay, promotion or redundancy;
  • never try to find out who gave an answer, or combine results with other data to do so;
  • never act against anyone for answering, or for not answering.

We agree to

  • We tell you within 72 hours of learning of a breach.
  • We email you at least 30 days before adding or replacing a subprocessor, and you may object.
  • Gists AI staff never see who wrote what.

Liability is capped at 12 months' fees, as set out in the Terms.

TakeOnePiece LLC
TakeOnePiece LLC
Signed
Customer
Name, title, signature
Add your signature and send it to support@gists.ai.gists.ai/dpa
03Subprocessors
gists.Subprocessors

Who helps us run Gists AI.

CompanyPurposeRegion
Google CloudHosting and storageUnited States
Google (Gemini)Themes, summaries and suggestions, only when AI is onUnited States
SendGridEmail deliveryUnited States
StripePaymentsUnited States

We email you at least 30 days before adding or replacing a subprocessor, and you may object.

TakeOnePiece LLC · support@gists.aigists.ai/legal
04Slack permissions
gists.Slack permissions

What Gists AI asks Slack for.

ScopeWhy
chat:writeSend each survey, and a short post after each survey about what changed.
chat:write.publicPost in the public channel you pick, without inviting the app first.
chat:write.customizeSend reminders under the Gists AI name and icon.
im:writeOpen each person's private message with Gists AI.
commandsThe /survey command.
channels:readList public channel names so you can pick where the post goes. Names only.
groups:readList private channels Gists AI was invited to, for the same picker. Names only.
users:readNames and time zones, so questions arrive at a sensible hour.
users:read.emailWork emails, to match each person to their HR record.
team:readYour workspace name, to set up your company.
usergroups:readBuild teams from Slack user groups when no HR system is connected.
Sign in with Slackidentity.basic, identity.email, identity.team, identity.avatar. Asked only when a person signs in to the web app with Slack, never at install.

Never reads channels, conversations between people, or files.

TakeOnePiece LLC · support@gists.aigists.ai/security#permissions
05Terms
gists.Terms

The agreement, in plain words.

Between TakeOnePiece LLC ("we") and the company that adds Gists AI to its Slack workspace ("you").

UseDon't use it to find out who wrote what or to get around the group size floor. The DPA is part of these terms.
Price$2.50 per person a month. Invoice or card. Only active people count. Someone who leaves stops counting once they're deactivated.
MonthlyMonthly: cancel any time in Billing. You pay for the month you're in, nothing after.
AnnualOne year at a time. Renews at the same price; we email 60 days before.
LeavingDownload all your company's data from Settings first: one file with people, teams, settings, and each survey's results, briefs and reports. Everything is deleted 30 days after you cancel, or after a trial ends without a plan; we email you 7 days before. Backups clear within two weeks after that.
LiabilityLiability is capped at 12 months' fees, as set out in the Terms.
LawMassachusetts.
TakeOnePiece LLC · support@gists.aigists.ai/terms
06Privacy Policy
gists.Privacy Policy

What we collect, and why.

ControllerFor survey answers, the employer. For visitors and buyers, TakeOnePiece LLC.
From SlackNames, work emails, time zones, user groups and channel names.
AnswersHow they are stored and who sees them: Security overview, above.
UseOnly to run Gists AI. We don't sell data, show ads, or use answers to train AI models.
RightsDelete all my data removes your check-ins and anything made from them. It can't remove survey answers: they're saved without your name, so nobody can find which ones are yours. Questions about your data? Write to support@gists.ai.
TakeOnePiece LLC · support@gists.aigists.ai/privacy
07Price for 400 people
gists.Price

Price for 400 people.

Monthly$1,000a month. Cancel anytime.
Annual$10,000a year. 2 months free.
  • $2.50 per person a month for your first 1,000 people.
  • $25,000 a year for your first 1,000 people. Volume discount: each person after that is $10 a year.
  • Invoice: annual plans. Card: monthly or annual.
  • Invoices are due in 30 days and carry your PO number.
  • Only active people count. Someone who leaves stops counting once they're deactivated.
TakeOnePiece LLC, 1 Broadway, Cambridge, MA 02142gists.ai/pricing