Security questionnaire responses
We'll complete your standard questionnaire, including the "no" answers.
Trust & security
Plainly, how Falen looks after your data.
Falen is a small product used by leadership teams, so the honest version is the useful one. Below is exactly where your data lives, who processes it, what protects it — and what we haven't built yet. Nothing here is aspirational: if it isn't in place today, it's marked as such.
Data location
EU — AWS eu-west-2 (London)
Sign-in
Passwordless email code
Isolation
Row-level security per organisation
Payments
Stripe only — we never see card numbers
Data & privacy
Where your data lives and what we hold.
Falen's application database runs on Lovable Cloud (managed Supabase infrastructure on AWS) in the eu-west-2 (London) region. All core application data stays in that EU region. Payments are processed by Stripe Technology Europe Limited, and transactional email and error reporting are delivered by Lovable's managed services — these may involve infrastructure outside the EEA.
What we store: your name and email address; your organisation, department, team and role membership; goal titles, metrics, values, units and statuses; check-in notes; email addresses of people you've invited but who haven't joined yet; your organisation's logo image; audit events; and Stripe customer and subscription identifiers.
What we don't do: no analytics or advertising trackers, no marketing cookies, no AI features, and no selling or sharing of your data. Runtime errors in the app are reported to Lovable's error telemetry (message, stack trace and page path) so we can fix crashes; no user data fields are deliberately attached.
GDPR posture: for your goal data Falen acts as processor and you as controller. Data is EU-hosted, and access, correction, export and deletion requests are handled manually by us — email security@falen.io and we'll respond within 30 days. We have not appointed a Data Protection Officer, as we are not required to.
Retention: account and organisation data is kept while the account is active. Customer content is deleted or anonymised within 90 days of account closure. Server logs and client-side error reports are retained for 30 days. Billing records are kept for as long as Estonian accounting law requires (currently seven years).
Application security
What actually protects the data.
- Encryption in transit. TLS on every connection — the app, the database API, Stripe and the email API.
- Encryption at rest. Provided by the underlying AWS/Supabase storage layer (AES-256). Falen does not add its own application-level encryption on top.
- Row-level security on every table. Access is scoped by organisation membership through security-definer checks, so one organisation cannot read another's rows.
- Managed platform patching. Database, auth and hosting run on managed infrastructure, so security patching at that layer is handled by the provider.
- No independent penetration test or security audit has been carried out on Falen to date.
- Falen holds no SOC 2, ISO 27001 or equivalent certification. Our infrastructure providers are certified (see below); we are not, and we won't imply otherwise.
Access controls
How people get in, and what they can reach.
- Passwordless sign-in. Users receive a one-time numeric code by email. Falen stores no passwords at all.
- Role-based access. Members hold a role — member, lead, head or admin — and those roles are enforced in the database by row-level security, not only in the interface.
- Invite-only membership. People join an organisation by invitation, and admins can remove members and reassign their goals.
- No SAML/SSO and no SCIM provisioning. On the roadmap, not available today.
- No separate MFA/2FA. Sign-in relies on control of the email inbox; there is no additional second factor to enforce.
- No scoped API keys or public API access.
Audit
What gets recorded.
Falen keeps an in-app audit log of key actions, visible to members of your organisation in Settings. It is a working record you can read yourself, not a compliance product.
- No configured retention policy. Entries are currently kept indefinitely with no automatic purge, and we make no retention or immutability guarantee.
- No audit-log export or streaming to an external SIEM.
Responsible AI
There is no AI in Falen.
Falen has no AI or machine-learning features. Your goals, check-in notes and company data are not sent to any model provider, and nothing you enter is used to train a model — because no model is involved anywhere in the product. If that ever changes, this page will say so before the feature ships.
Sub-processors & infrastructure
Everyone who touches your data.
This is the complete list. Certifications shown belong to the provider, not to Falen.
| Provider | What it does | Data it handles | Region | Provider certification |
|---|---|---|---|---|
| Lovable Cloud (Supabase on AWS) | Database, authentication, file storage, app hosting | All customer data | eu-west-2 (London) | Supabase: SOC 2 Type 2 |
| Stripe Technology Europe Limited | Payments and billing | Card details, billing name and email, invoices | Ireland / EU (Stripe's Irish/EU entity, which handles EU/EEA customers) | PCI DSS Level 1 |
| Lovable managed email | Sign-in codes, invites, reminders, weekly summaries | Recipient email addresses and message content (may include goal titles and names) | Not publicly specified | None stated by the provider |
| Lovable error reporting | Client-side crash reporting | Error message, stack trace, page path | Not publicly specified | None stated by the provider |
Falen's email is sent from noreply@falen.io via the verified subdomain notify.falen.io. Card numbers never reach Falen's database — we store only Stripe customer and subscription identifiers and statuses.
Documents on request
Ask and we'll answer in writing.
We don't have a document portal or a certification pack, because we don't have certifications. What we will do is answer your security questionnaire honestly and put anything you need in writing. Email security@falen.io.
Data processing agreement
We intend to sign a data processing agreement with each sub-processor and to rely on Standard Contractual Clauses for any transfer outside the EEA. Send us your template and we'll review and sign.
Sub-processor list
The table above is the current list; we'll confirm it in writing on request.
Data export or deletion
Handled manually by us today. Email the request and we'll complete it within 30 days.
On the roadmap, not available today: SAML SSO, SCIM provisioning, enforced MFA, self-serve organisation data export, a self-serve "delete my account and all data" flow, configurable audit-log retention, and an independent security audit.