Security Policies

Where the Service Runs

• The application and its database run on servers in Germany.
• Uploaded files and database backups are held by a storage provider in the European Union.
• The owning company, Fareeqy LLC, is registered in the United States.

The regulations that apply to the processing of your data are covered in the privacy policy.

Encryption

• In transit: HTTPS is enforced on every request; unencrypted connections are refused and redirected.
• At rest: database volumes and object storage are encrypted at the infrastructure layer by our providers.
• At the field level: sensitive tokens, such as Google integration access and refresh tokens, are encrypted inside the database itself, so they are unreadable even from a copy of it.
• Passwords: never stored as text, only as a one-way bcrypt hash.
• API keys: stored as a SHA-256 digest. The key is shown once at creation and cannot be retrieved afterwards, by you or by us.

Tenant Isolation

Fareeqy is multi-tenant, and every query in the system is scoped to the current company and the user's permissions rather than to an identifier arriving from the URL. Reaching a project passes through an independent authorization layer before it reaches data, covered by tests that fail deliberately if any guard is removed.

Permissions inside a company come in three levels, with custom roles definable on higher plans, so a member sees only what was assigned to them or made public within their own company.

Backups and Restore

• Continuous backups rather than daily ones: the transaction log is archived every 60 seconds.
• A full backup every 24 hours, with at least three full backups retained at all times.
• Point-in-time recovery to any moment in the last 7 days, not just to the newest backup.
• Backups are stored away from the application servers themselves, so both cannot be lost together.

And the part that matters most: we test restores. The most recent test was on 7 September 2026, restoring the database to a specific moment on the previous day and comparing the numbers against production, which matched. A backup that has never been restored is not a backup, it is an assumption.

Application Hardening

• Rate limiting on sign-in, password reset and confirmation resend, to blunt guessing and abusive automation.
• Virus scanning: every uploaded file is scanned by antivirus before it can be downloaded, with type and size validation.
• Content Security Policy with no unsafe-inline and no unsafe-eval, using a per-request nonce.
• CSRF protection on every form, with signed and encrypted sessions.
• Email confirmation required before an account is activated.

Audit Logs

We keep a record of what is worth tracing, not of everything:

• Role and permission changes: who changed what, and when.
• Creation and use of API and MCP access keys, including refused attempts.
• Company deletions.
• Billing operations and subscription changes.

These logs have different lifetimes: the access-key usage log is deleted automatically after 90 days, while permission-change and billing records are kept longer, because they are what lets you see who changed what and when. The detail is in the data retention section of the privacy policy.

Our Team's Access to Your Data

Nobody on our team looks at your workspace content in day-to-day work. Access happens in two cases only: with your explicit permission to resolve a fault requiring manual intervention, or in response to a binding legal request.

Our internal admin surface is built on a single rule: it reports how much a customer uses Fareeqy, never what they wrote in it. Project, task, comment and file names do not appear there.

Fareeqy Assistant and AI

• Nothing is sent to any AI provider unless you use the Assistant yourself.
• Only the minimum needed to carry out your request is sent, within your own account's permissions rather than the company's. Your workspace is never sent wholesale.
• Every write the Assistant proposes passes through an editable confirmation card before execution. It writes nothing until you press confirm.
• Your content is not used to train models.

Data Deletion

Company deletion is self-serve and immediate: the workspace closes on confirmation, and erasure begins within seconds and usually completes within minutes, from both the database and the storage service.

Data remains inside backups for a maximum of 7 days, then leaves them as the recovery window expires. Those backups are used only to restore service after a failure.

Reporting a Vulnerability

If you find a security vulnerability, write to support@fareeqy.com before disclosing it anywhere, and we reply within 3 business days. We do not pursue anyone who reports in good faith without destroying data or accessing other people's accounts.

For privacy questions: privacy@fareeqy.com