How your data is kept, and who can see it.
What protects your company’s records and files today, stated plainly, including what is not in place yet. The legal wording is in the privacy notice.
Where your data lives
One provider runs the website, the app, the database and the file storage.
- CloudflareHosts the website and the app. Records are in Cloudflare’s database (D1), files in private storage (R2), with a location hint for Eastern North America.
- Private filesFiles are not public. They can only be downloaded through the app, after a check that you belong to the company that owns them.
- Encrypted connectionsThe website and the app are served over HTTPS only, with security headers.
- Other providersGoogle Workspace hosts our support mailbox. FormSubmit delivers the website support form to it. Cloudflare sends the app’s emails.
Who can see it
Your workspace is visible to your company account, and to nobody else by default.
- Separated per companyEvery request is checked against your company account. Automated tests try to break that separation.
- Support only with your permissionSupport can open your workspace only if the company owner turns it on in Settings: for 7 days, can be ended any time, every visit listed.
- Operators, only when neededThe people who run the service can technically reach the database and file storage. They do so only for operations, security or a legal obligation.
- No network accessPrequalReady never asks for your ISNetworld, Avetta or Veriforce password and never logs in to them.
Accounts and sign-in
Protections on every account, whether or not you pay.
- Confirmed emailAn account opens only after its email address is confirmed with the emailed link.
- Hashed passwordsPasswords are stored only as a salted hash (scrypt). Nobody can read them, including us.
- Rate limitsSign-in, sign-up and email sending are limited, and an account is blocked for a while after repeated wrong passwords.
- Sessions endA sign-in lasts up to 7 days. Logging out ends it on the server.
Backups and deletion
What can be recovered, and how deletion works.
- 30-day database historyThe database keeps a 30-day point-in-time history, so records can be restored after a mistake. A restore has been tested.
- Files: keep your originalsFiles are stored privately but are not yet backed up separately. Keep your own copies of important documents.
- Deleting a documentRemoves it from file storage right away, together with its older versions.
- Deleting your accountWrite to us from the account’s email address; we delete the account and workspace within 30 days and confirm by email.
What we never do
- No selling dataWe do not sell your information or show advertising.
- No trackingNo advertising or analytics cookies, no analytics tracking. The app sets only the cookies needed to keep you signed in.
- No AI training on your dataYour workspace content is not used to train AI models, and the app has no AI features that read your documents.
- No secrets in logsOur logs never contain your password, your email address or sign-in tokens.
Not yet in place
PrequalReady is new software in early access. These are not available today.
- No security certificationWe do not hold SOC 2, ISO 27001 or similar certifications.
- No two-step sign-inTwo-step sign-in for customer accounts is not available yet. Use a long, unique password.
- No separate file backupsKeep your own copies of important documents.
- One login per companyNo team members or single sign-on yet.
Report a problem
If you think you found a security problem, or something in your workspace looks wrong, email [email protected] with the word “Security” in the subject. Please do not test the service’s security without our written permission. If we learn of a breach that affects your data, we will tell you without undue delay.