Security and privacy
Security at Fiuto
These statements describe Fiuto's current technical and operational controls. Fiuto does not claim a security certification. See the security summary on the homepage.
Data handling and deletion
Fiuto does not sell personal data or use advertising trackers. Account deletion removes Fiuto-owned data, subject to disclosed processor retention.
No selling or advertising trackers. Fiuto does not sell personal data or use advertising or marketing trackers.
Raw results export. Raw study results can be exported as JSON or CSV on Core and Pro. Raw export is not available on Free.
Account deletion. Closing an account deletes Fiuto-owned study data, storage objects, Stripe customer records, and PostHog person and event data where applicable. Some collaborator grants must be transferred or revoked first. Anthropic retention follows its commercial terms rather than Fiuto's account-deletion flow.
Recent sign-in required. Account deletion requires a recent sign-in. A stale or unverifiable session is refused until the account holder reauthenticates.
Respondent identifiers are limited. Fiuto response tables store salted hashes of respondent IP addresses and user agents, not the raw values. Raw exports omit referrer data.
Respondent analytics is metadata only. When a respondent completes a study, analytics does not capture their email address or written answers.
Processors are disclosed. The Privacy Policy lists Fiuto's infrastructure and product processors, what each one does, and the separate user-directed integrations Fiuto can connect to.
Primary storage regions. Fiuto's Supabase database is hosted in EU West, recordings are stored in Cloudflare R2 in the EU, and PostHog replay data is retained in its EU region. Some providers process personal data outside the UK and EEA under their standard transfer safeguards.
Account and study access controls
Core customer data is owner-scoped at the database level. Collaboration and public-share paths use separate, explicit access controls.
Database-level isolation. Row-level security restricts core product rows by owner. Access granted through collaboration and public share links follows separate policies and capability checks.
No self-upgrade. An account cannot grant itself a higher tier or access another account.
Backend ownership checks. Privileged backend paths that return owner-scoped records apply explicit ownership checks in addition to database policies.
Restricted diagnostics. In-product trace, log, and feedback views are restricted to flagged engineer accounts. Provider-hosted logs and analytics remain subject to each provider's access controls.
Scoped credentials. Authenticated functions verify a user session or scoped token before acting. Anonymous respondent and public-share paths use separate capability, isolation, and rate-limit controls where applicable.
Multiple sign-in methods. Supported sign-in methods include Google, GitHub, magic link, and email with password.
Timing-safe bearer checks. Bearer-token comparisons use timing-safe checks where raw-token comparison is required.
Encryption and secret storage
Product traffic uses TLS. Managed stores encrypt data at rest, and connector secrets are encrypted before storage with server-only keys.
Encrypted in transit. Every connection uses HTTPS, and browsers are instructed never to downgrade the connection.
Encrypted at rest. The database resides on encrypted, managed infrastructure.
Connector secrets are sealed. Tokens for connected tools are encrypted with a key the database itself cannot access. A database dump does not yield usable secrets.
Secrets open only on the server. Stored secrets can be decrypted only on the server; the web app has no capability to decrypt them.
No secrets in the browser. The shipped app carries no service keys, no AI key, no connector secrets.
AI uses Fiuto's own credentials. Users never paste an API key into the product, so there is no user-held key to leak.
AI data handling
Fiuto sends AI prompts to Anthropic's commercial API. Prompt content is not sent to PostHog, which receives LLM metadata only.
Anthropic processing. Fiuto's server sends AI API calls directly to Anthropic using Fiuto credentials. Under Anthropic's commercial terms, API inputs and outputs are not used for model training by default and are generally retained for up to 30 days, subject to standard exceptions. Fiuto does not have a zero-retention arrangement.
Content sent for AI features. Prompts can include user messages, study content, requested connector context, and respondent answers when analysis is requested.
Agent runs are traced. Agent runs are recorded step by step for quality and abuse review. In-product trace access is restricted to flagged engineer accounts.
Internal addresses are blocked. When the AI fetches a URL, internal and cloud addresses are blocked, and swapping the address mid-request is prevented.
Connectors stay server-side. Slack, Notion, GitHub, and Linear calls never reach the browser.
Application security controls
Product code and dependencies are reviewed before release. Runtime controls include input validation, output escaping, rate limits, and restrictive browser headers.
Code is scanned for known risks. Changes are checked against known vulnerability patterns before release.
Dependency vulnerabilities are tracked. Known-vulnerable dependencies are flagged, reviewed, and updated through the normal release process.
Input is validated before storage. Study content and responses are validated against strict schemas before storage.
Output is escaped by default. Fiuto escapes user-supplied content when rendering it and does not use raw HTML execution paths.
Product pages use restrictive headers. Product web responses carry a Content Security Policy, frame blocking, a no-referrer policy, and restrictive browser permissions. API responses use controls appropriate to their endpoint.
Script sources are restricted. Product pages allow scripts from Fiuto and Cloudflare Turnstile. Inline scripts are blocked by the Content Security Policy.
Recurring security review. Fiuto conducts internal security reviews and tracks findings to remediation or an explicit documented acceptance. This is not a third-party certification or attestation.
Respondent data and consent
Respondents do not need a Fiuto account. Studies can collect answers, intake fields, clicks, timing data, and optional recordings.
No Fiuto account required. Respondents open a study through its share link without creating a Fiuto account. A study can still ask for personal data in intake fields or written answers.
Consent comes first. Analytics activates only after opt-in consent, and screen, microphone, or camera recording requires a separate consent.
Recordings are private to the study owner. Sessions are held in a private store, reachable only by the study owner, through short-lived signed links.
Recording retention and deletion. Deleting the relevant launch, study, or account removes its recording files. Recording media is also deleted automatically about 12 months after capture, and abandoned uploads are cleaned up after 7 days.
Search indexing is discouraged. Public share pages send directives telling search engines not to index them. These directives do not make a forwarded share link private.
Playback leaks no referrer. Playback requests send no referrer header, so a signed link never reveals the study owner's results page.
Share links are the access control. Share links are long, random, and unguessable, but they grant access to anyone who has the link; the study owner should distribute them accordingly.
Study owner responsibilities. The study owner decides what to ask, who receives the link, the lawful basis for collecting responses, and how long non-recording responses are kept.