Security & Privacy

The prompt itself, and the AI response, are not retained once the response is generated. However, if you save a document, both the document and the form inputs used to create it are stored in your account so you can reopen and edit them later - this may include names, contact details and other personal data you typed in. Exporting to Word or PDF downloads a copy to your device and does not by itself store anything in your account. See the Privacy Policy for full detail.

Saved outputs are stored in your account on Supabase (EU region, Ireland eu-west-1). Encrypted at rest (AES-256) and in transit (TLS 1.3). Row Level Security ensures that only you, the members of any workspace you belong to, and guests you invite into a project room (for what you choose to share) can access your data. Uploaded files are private and are opened only through temporary links that expire after one hour.

RLS policies restrict access by user ID. Administrative database access is limited to the company owner for maintenance/support only, is not used to view individual documents, and is logged. You can download documents locally at any time.

Authentication is handled by Supabase Auth (bcrypt password hashing, secure session management). Login attempts are rate-limited to prevent brute-force attacks.

They are sent over HTTPS only and are used only by our own site. The sign-in cookie, set by our sign-in provider Supabase, holds your user ID and email address; the app's own code can read it, which it needs in order to work, and it uses SameSite=Lax. A separate session check cookie cannot be read by the app's own code (HttpOnly) and also uses SameSite=Lax. The platform and the app set no tracking cookies and do not read any. Full list: Cookie Policy.

Yes. Tool and account API routes require a valid authenticated session and return a 401 to unauthenticated requests, enforced in middleware. A small set of public endpoints (login, contact, the question box on our website, Stripe webhook, promo validation) are exempt by design and are individually rate-limited or token-gated.

No. Your key is encrypted at rest with AES-256-GCM and decrypted server-side only at the moment an API call is made. It is never sent to your browser, never appears in any inspectable network request, and is never written to a log. All AI calls happen server to server. We do not display the key again after you save it, and we delete it when you remove it or close your account.

No, not inside the app. Every tool in the app needs you to be signed in, and a request without a session is refused before any AI call is made. The one exception is the short question box on our public website, which answers general questions about FitOut Insider without a login. It is rate-limited and never sees your project data.

Your inputs are sent to Anthropic's Claude API, using your own connected key, or our own Anthropic account during your free trial and in the support chat, to generate your output. By Anthropic's policy, API inputs are not used to train models. FitOut Insider does not retain a copy of the prompt or the response after the response is generated. Anthropic remains our sub-processor for this processing, as set out in the Privacy Policy and the Data Processing Agreement.

Every plan runs on your own Anthropic key. You hold the account with Anthropic, you pay Anthropic directly at their published rates, and we add no margin. We do not supply or resell a key. The only exceptions are your free trial and the support chat, which run on our own account at no cost to you; apart from those, no usage allowance is included in your subscription. See clause 7 of the Terms of Use.

Yes. Our host, Vercel, provides DDoS protection, a global CDN and automatic edge mitigation.

Yes. HTTPS enforced via automatic TLS certificates; HTTP redirects to HTTPS; HSTS set.

Content-Security-Policy, X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy, and Strict-Transport-Security (HSTS). The app (app.fitoutinsider.com) also sets Cross-Origin-Opener-Policy and X-DNS-Prefetch-Control. We do not send X-XSS-Protection - every current browser has dropped its built-in XSS filter and ignores it, and our Content-Security-Policy is the real, working defence.

Built for UK GDPR, with a Data Processing Agreement included. Data stored in the EU (Ireland), minimal personal data, no analytics/tracking cookies, full rights of access/rectification/erasure. The Agreement forms part of the standard terms every customer accepts, and is published on the Legal page.

Yes, and you do not have to ask us. Delete account in your settings destroys your profile, projects and saved documents immediately and permanently - we cannot restore them afterwards. Records we must keep by law, such as billing and VAT records, are kept for the periods in our Privacy Policy. If you would rather we did it, write to hello@fitoutinsider.com and we will respond within 30 days, which is the deadline UK GDPR sets for answering a request of this kind. Note that this is different from simply letting a subscription end, where your data is kept for 90 days in case you come back. Our database backups run on a seven-day cycle, so a deleted record may sit in a backup, inaccessible, until it is overwritten. Uploaded files are also copied to a separate daily backup, where a deleted file is kept for up to seven days before it is removed.

We use Vercel Web Analytics, a cookieless analytics tool provided by Vercel, Inc. that collects no personal data, sets no cookies, and does not track visitors across websites or devices. No Google Analytics, advertising pixels, or session-recording tools are installed, and no tracking cookies are set. Usage is not profiled beyond the AI request count shown back to you in your account.

We have not yet commissioned an independent third-party penetration test. The platform is built secure-by-default: data is stored on Supabase (EU region, Ireland eu-west-1) with row-level security, all connections use TLS 1.3, and access is scoped to the account and workspace the data belongs to. We will publish independent assessment results here as they become available.

Supabase is SOC 2 Type II, ISO 27001, and GDPR compliant. AES-256 at rest, TLS 1.3 in transit, and Row Level Security so that one customer cannot reach another customer's data even if the API layer is compromised.

Your account data and saved documents are stored on Supabase in the EU (Ireland, eu-west-1) and are not stored anywhere else, apart from a separate daily backup copy of uploaded files, from which a deleted file is removed after seven days. Some of the services we rely on to run the platform are outside the EU: our application code runs on Vercel in London, our email is sent through Resend in the United States, our rate limiting and session security use Upstash (a US company, with the data itself stored in London, UK), and payments are handled by Stripe. Each of those is named in our Privacy Policy with the data it handles and the transfer safeguards that apply. AI processing through Anthropic in the United States is transient and covered by standard contractual clauses.