Security
How we handle your data.
Read-only access you can revoke, a store only your workspace can read, EU hosting, no model training, and a plain list of what is not in place yet. Built and run in the United Kingdom.
Access to your sources
- Connections use read-only OAuth scopes, or a vendor API key where a provider offers no OAuth. Confluxly never asks for write access.
- Tokens and keys are encrypted at rest with AES-256-GCM. The plaintext columns were removed; nothing can read a token except the function that uses it.
- Disconnecting revokes the grant at the provider where that is safe, and stops every fetch. The history already held stays until you ask for it to be erased.
The store
- Every table is protected by row-level security scoped to workspace membership. Your workspace can read what it owns and nothing else.
- The store is read-only to clients. Only our server-side connectors can write to it, and no model is anywhere in that path.
- Raw provider responses are kept in private storage with no client access, for ninety days, and permanently for the first backfill.
Accounts and sessions
- Signing out, or changing your password, revokes every session server-side.
- Sign-up is invite only and rate limited per address, and attempts are logged as hashes rather than plaintext.
- Database functions are locked down by default and only granted where a feature needs them.
The AI
- Questions and briefs go to Anthropic's models through our own server functions, never from your browser. Anthropic does not train on data sent through its API, and neither do we.
- The model can only choose from figures held in the store and layouts in a fixed library. Every answer and slide is checked against the figures before you see it.
- Rate limits and a monthly allowance apply to every account.
How long we keep things.
| What | How long |
|---|---|
| Figures in the store | Fourteen months, then dropped by month |
| Raw provider responses | Ninety days; the first backfill is kept |
| Deleted decks and dashboards | Thirty days in trash, then purged |
| Closed accounts | Access ends at once; everything purged after thirty days |
| Activity history | Ninety days |
| AI request log | Twenty-four hours |
Who else touches it.
| Provider | For | Where |
|---|---|---|
| Supabase | Database, storage and server functions | AWS, EU |
| Vercel | Hosting for the app and this site | Global edge, EU origin |
| Anthropic | The models behind Ask and deck building | United States, under the UK IDTA and EU SCCs |
| Resend | Email for comments, assignments and this site's forms | United States, under the UK IDTA and EU SCCs |
Not in place yet.
Still to do
If one of these is a condition of buying, tell us. It moves the order we do them in.
Tell us what you need- SOC 2 or ISO 27001. No audit has been commissioned yet.
- Single sign-on and two-factor authentication. Both are on the roadmap.
- A countersigned data processing agreement. The DPA is published; a signing flow is being set up.
- An independent penetration test.
- A public status page.
The full detail is in the privacy policy and the data processing agreement. Questions to privacy@confluxly.ai.