Security
How Facets protects your data.
Where it runs, who can reach it, what the backups guarantee, and where our compliance program currently stands.
For who can see what inside the product — which roles read which data, and why the two halves of the product cannot be joined — see who can see what.
Infrastructure
Facets operates no servers of its own. Everything runs on two managed platforms, so their controls are the controls.
Supabase — database, authentication, storage
Managed PostgreSQL 17 in AWS us-east-1. Supabase states it is SOC 2 Type 2 compliant, ISO 27001 certified and HIPAA compliant, and that customer data is encrypted at rest with AES-256 and in transit via TLS.
Vercel — application hosting
Vercel states it holds a SOC 2 Type 2 attestation, is ISO 27001:2013 certified, holds a PCI DSS SAQ-D Attestation of Compliance, is certified under the EU-U.S. Data Privacy Framework, and encrypts data at rest with AES-256.
Sub-processors
Transactional email through Resend; narrative report text through Anthropic, covered below. All are named with their purpose in the privacy policy.
Data residency
Database and hosting are both in the United States for the product as we run it. A dedicated instance can be created in another region. Either way the region is fixed at creation, and customers will be told in advance if that ever changes.
Access control
Administrative access to production is limited to named operator accounts, controlled by an allowlist in the deployment configuration together with a roster we can revoke immediately. Each must also pass a one-time code from an authenticator app. Every access to a released report is logged.
Row-level security is enabled on every table. The tables holding raw ratings, comments and self-assessments have no read policy for any signed-in account at all — they are reachable only by server code holding a service credential, and only after it has verified a single-use participant token or a staff role.
The operator console is blocked at the column level from manager-side records — assessments, goals, 1:1 notes, colleague input. A test fails the build when a new table is added and nobody has decided which side of that line it belongs on.
Participant links are single-use, randomly generated, and stored only as a one-way hash, so an existing link cannot be looked up or read back by anyone, including us. A lost link is re-issued, which invalidates the old one.
Backups and recovery
Schedule and retention
Automatic daily backups, kept on a rolling seven-day window, held in the same region as the database.
Recovery point
Up to 24 hours of writes could be lost in a restore. Point-in-time recovery is not currently enabled. No recovery time is published, because none has been measured.
Deletion, end to end
Raw answers are deleted from the live database within 90 days of a team or organization leaving the service. A backup taken before that deletion retains them until it expires, at most seven days later — so the honest end-to-end figure is 97 days. Leaving is either closing the workspace yourself, which starts the clock that day, or your last subscription or purchase lapsing, which starts it from the date the entitlement ended rather than the date we noticed. A nightly job does the deletion and records what it removed.
Scope
Backups are held within the same platform as the database. There is no independent off-site copy today.
AI
Scoring is entirely deterministic. No model decides a number, a threshold, or whether a result is shown to anyone. Where a model is involved it writes narrative; who can see what sets out exactly what it receives in each case.
The provider is Anthropic, whose commercial terms state that Anthropic may not train models on customer content from the services. Nothing written in Facets trains a model.
With no AI provider configured, a deterministic template writes the report instead, and writes a complete one. A customer who does not want a model near their data is asking for a supported configuration rather than an exception.
Application security
Standard hardening headers on every route, with an enforced Content-Security-Policy. Participant link routes sit behind rate limiting at the network edge. No analytics, tag manager, chat widget or advertising script runs anywhere in the product, and fonts are self-hosted.
In August 2026 the application went through a full internal security review covering authentication and sessions, database-level tenancy rules, participant routes, server actions, billing and model prompts, and web hardening and supply chain. Everything it found has been fixed, each verified by reproducing the issue against a database without the change and confirming it denied with it.
Reporting a vulnerability
Write to security@facets.team. You will get a human reply and be told what happened to what you sent. Testing against your own data is welcome; testing against another customer’s is not, and neither is anything that degrades the service for people using it. There is no bug bounty. Credit on this page is offered to anyone who wants it.
Current status
Where the compliance program stands today, so a review does not have to ask.
- No SOC 2 or ISO 27001 of our own. The platforms underneath hold theirs.
- No external penetration test. The August 2026 review was internal.
- Two-step verification is available on every account. Sign-in is a one-time link by email — no password to reuse or leak — and with two-step on, a new browser also needs a six-digit code from an authenticator app. Our own operator accounts carry the same second factor.
- SAML single sign-on is supported, configured by us with your identity provider rather than self-serve. There is no SCIM provisioning: an account is created on first sign-in, and removing someone is done in Facets.
- No deletion of a single run or a single person’s answers. Export is self-serve — an owner or admin downloads the whole workspace from Settings → Workspace, a manager downloads any person’s record from their page, and closing a workspace starts the ninety-day deletion described above. Anything narrower than that, and account deletion for somebody who is the sole owner of a workspace that still holds data, is done on request through the contact form, which reaches us directly with no account needed.
- No off-site backup copy, and a seven-day retention window.
- No published uptime figure, as none is measured. A service level agreement is available in a negotiated annual contract; there is no standing one.
Questions
Security questionnaires are welcome and get filled in honestly, blanks included. Send one through the contact form, or pick the privacy reason instead for data protection, access and deletion.