Security

How we protect your information

• Encryption. Your information is encrypted as it travels over the internet and while it’s stored, backups included.
• Separation. Each foundable’s information is kept separate, and we check that you belong to a foundable on every request before showing or changing anything in it.
• Sign-in. You sign in with Google, Apple or a code we email you, through a dedicated sign-in provider. We never see or store a password.
• Isolated work. Ted builds and runs websites in isolated environments that can reach only what each job needs.
• Connected accounts. The logins for the apps you connect are held by the providers that manage those connections, not stored by us.
• Secrets. Our own keys are kept in a dedicated secrets manager and never sent to your browser.
• Backups. We keep regular backups so we can recover from a failure.
• Your content and AI. We don’t train AI models on your content.

Who can access it

Access to our systems is limited to the people who need it for their work. Changes are tested on a separate environment before they reach Foundable. Our team looks at your content only when we need to, to help you when you ask, keep Foundable secure, stop abuse or meet a legal obligation, and helping you through support doesn’t make anyone a member of your foundable. We remove personal details from error reports before they’re sent.

Your part

Keep the email and accounts you sign in with secure, only connect services you trust, and give teammates their own accounts. If you think your account has been compromised, email security@foundable.com right away.

If something goes wrong

If a security incident affects your personal information, we’ll investigate and contain it and tell you without undue delay, and for businesses within 72 hours, as the law and our Data Processing Addendum require. We post service outages on our status page.

Reporting a vulnerability

If you’ve found a security issue, email security@foundable.com and follow our Responsible Disclosure Policy. We aim to reply within 3 business days.

For businesses

• Our Data Processing Addendum is part of our Terms for every account, with the EU Standard Contractual Clauses included, and our subprocessor list names every provider.
• We don’t sell personal information. Card payments are handled by Stripe, and we never store card numbers.
• Foundable is built for everyday business information, not health records covered by HIPAA.
• For a security questionnaire or other questions, email security@foundable.com.