Trust & Security

This page describes the technical and organisational measures Faindo implements to keep your data secure. For full legal commitments, see our Privacy Policy and Data Processing Addendum.

Security contact: team@faindo.com

Infrastructure and hosting

ComponentProviderDetails
Edge hosting & CDNCloudflare WorkersGlobal edge network; DDoS protection included
DatabaseMongoDB AtlasDedicated cluster; data encrypted at rest (AES-256)
AuthenticationFirebase Authentication (Google)Managed identity; password hashing; MFA support
API runtimeCloudflare WorkersStateless serverless; no persistent compute instances

Data is primarily hosted in the European Union (Frankfurt, eu-central-1 equivalent). Some subprocessors operate in the United States under applicable SCCs — see the subprocessor table below.

Encryption

  • In transit: TLS 1.2 or higher on all connections between client, edge, API, and database. HSTS is enforced on faindo.com.
  • At rest: MongoDB Atlas encrypts all data at rest using AES-256. Cloudflare Workers KV and storage are encrypted at rest by Cloudflare.
  • Authentication tokens: Firebase issues short-lived JWTs. Refresh tokens are managed by Firebase and are not accessible to Faindo application code.

Access control

  • Production database access is restricted to authorised Faindo personnel on a need-to-know basis.
  • Access is authenticated via MFA-enforced tooling.
  • Access events are logged and reviewed periodically.
  • No third-party vendor has broad production access unless contractually required and audited.

Vulnerability disclosure

If you discover a potential security vulnerability in the Faindo platform or infrastructure, please report it responsibly:

Email: team@faindo.com — include "Security" in the subject line.

We will acknowledge receipt within 2 business days and provide a resolution timeline. We do not pursue legal action against researchers who report vulnerabilities in good faith.

Please do not test against live customer accounts or production data without prior written authorisation.

Incident response

In the event of a personal data breach affecting Customer data, Faindo will:

  1. Notify affected Customers within 72 hours of becoming aware of the breach.
  2. Provide details of the nature of the breach, data categories affected, and measures taken to contain it.
  3. Cooperate with regulatory authority notifications where required.

Full obligations are set out in Section 8 of our DPA.

Subprocessors {#subprocessors}

The following third parties process data on Faindo's behalf. Each is bound by a data processing agreement. Changes to this list are notified to Customers at least 30 days in advance per our DPA.

SubprocessorPurposeLocationPrivacy / Security
Google LLC (Firebase)AuthenticationUSASecurity overview
MongoDB, Inc. (Atlas)DatabaseUSA (EU clusters available)Security overview
Cloudflare, Inc.Edge hosting, CDNUSA (global edge)Trust hub
Calendly, LLCDemo schedulingUSAPrivacy Policy
PostHog, Inc.Product analytics (consent-gated)USA / EUSecurity overview
Google LLC (Google Analytics)Web analytics (consent-gated)USAPrivacy overview
Meta Platforms, Inc. (Meta Pixel)Marketing attribution (consent-gated)USAPrivacy Policy
OpenAI, LLCAI model queriesUSASecurity overview
Anthropic, PBCAI model queriesUSAUsage Policy
Google LLC (Gemini)AI model queriesUSAGoogle Cloud Security
Perplexity AI, Inc.AI model queriesUSAPrivacy Policy
xAI Corp (Grok)AI model queriesUSAPrivacy Policy

Compliance

  • GDPR (EU 2016/679): Faindo is a processor under GDPR when processing personal data on behalf of Customers. See our DPA for processor obligations, including Standard Contractual Clauses for international transfers.
  • Data residency: Primary data is stored in EU regions. Contact team@faindo.com to discuss specific data residency requirements.

Questions

For security questions or to request a security summary, write to team@faindo.com.