Security

Security questionnaire

The questions a buyer's security review asks, answered from the code that runs the work. Where we do not do something, the answer says so.

Updated 4 November 2026 Questions: [email protected]
Contents
  1. 01Access control
  2. 02Authentication
  3. 03Encryption
  4. 04Incident response
  5. 05Backups
  6. 06Logging and audit
  7. 07Vendor management
  8. 08Data residency
  9. 09Retention and deletion
  10. 10AI use
  11. 11Certifications and testing

Access control

Who can open a customer's record?
Our staff, signed in with a second step. A person signed in to that record by a code emailed to an address on it. Each staff open is recorded.
Is access limited by role?
Customer data is open to our staff, signed in with a second step. A sales representative sees only the firms they hold.

Authentication

Do staff use a second step to sign in?
Yes. Staff, sales representatives and partner portal owners must. Customers can turn it on.
How are repeated failed sign-ins handled?
They are limited per username at an address. The address is blocked after repeated failures.
How long does a session last?
A staff or account session ends after seven days. A customer page sign-in lasts 30 days, or 12 hours on a shared computer.

Encryption

Is data encrypted in transit?
Yes. Every page is served over HTTPS with HSTS set for one year.
Are backups encrypted?
Yes, with AES-256-GCM before they leave our hosting provider. The key is kept apart from our code.
How are passwords stored?
As salted hashes only. Card details never reach our systems.

Incident response

How do you learn of an incident?
A critical alert is emailed to our desk the moment it is raised. Error reports go to Sentry.
How fast do you tell a customer?
Within 72 hours of learning that a breach of our safeguards involves the customer's information.
Do you keep a record of breaches?
Yes, every one, for at least 24 months.

Backups

How often are backups made and where are they kept?
Daily. Cloudflare keeps the most recent 72 and a private GitHub repository the most recent 14.
Are restores tested?
Yes. A monthly drill restores a backup to a throwaway copy and checks it.

Logging and audit

What is logged?
An evidence record of what was agreed, ordered, paid, delivered and changed, each entry chained to the one before it so a later change can be detected.
How long is the evidence record kept?
Fifteen years from each entry. The network address and browser on a sign-in entry are removed after 24 months.
Can a decision be traced?
Yes. Each decision is one append-only row, its subject kept as a keyed hash.

Vendor management

Which vendors receive data?
Every one is on the subprocessor page with what it receives and why.
How do you stop code from sending data to a vendor you did not choose?
A guard refuses any request that sends data to a host off one written list, before a connection opens.

Data residency

Where is customer data stored?
In the United States, on Railway, with encrypted backups at Cloudflare and GitHub.

Retention and deletion

Can a customer have its data deleted?
Yes. Write to [email protected] and we delete what we hold and confirm in writing within 30 days. The evidence record and purchase records are kept as the law requires.
Does deleted data stay in backups?
It ages out as older backups are replaced, within about ten weeks.

AI use

Which models do you use?
Models from Anthropic (Claude), Google (Gemini), OpenAI, Microsoft Azure AI, Perplexity and xAI. The Claude models are claude-sonnet-5-5 and claude-haiku-5-5.
What is sent to a model?
A firm's public facts and stored findings, text from its own public pages, a question someone typed into an assistant and email that reaches our mailboxes when the inbox agent sorts it.
Does customer personal information go to a model?
Card details never reach our systems. Passwords and sign-in codes are kept only as hashes. None of them can be in a prompt. Where a use carries a named person's details, How our AI works names it.
Do demonstration records spend on a model?
No. A demonstration or test record is refused before any model is asked.
Does a model release anything by itself?
No paid assessment is released without a person's approval. A model's review informs that approval and changes nothing.
Are prompts and replies traced?
Yes, by hash. A chat answer and an inbox decision carry the SHA-256 of the prompt, the context and the actions proposed. The words are not kept in the trace.

Certifications and testing

Do you hold SOC 2 or ISO 27001?
No. We hold no security certification and do not claim one.
Has an external penetration test been run on your production systems?
Not yet.
Can someone report a weakness to you?
Yes. Write to [email protected]. We acknowledge every report within 72 hours.