Security & Trust
Profusia hosts documents that businesses send to their clients. This page describes how they are protected, and — just as deliberately — what we do not yet claim.
What we do
Every customer's data is isolated at the query layer
All database access runs through a single scoped choke point that binds every statement to one workspace. A query that forgets to scope itself isn't a bug we watch for — it can't be written. An automated test proves it: two separately-authenticated workspaces, one handed the other's real file identifier, and the request correctly fails.
Documents are private until you share them
Nothing you publish is reachable without a credential. Share links carry a high-entropy secret, can expire, and can be revoked individually or all at once. Every credential we issue — share links, embed links, sign-in sessions, access keys, OAuth tokens — is stored only as a hash, so reading our database yields nothing you could present back to us. There is exactly one deliberate exception, and naming it is the point of this page: if you upload a company logo, it is served from your own subdomain without a credential, because it appears on pages you have shared with people outside your organisation. Nothing else is.
Accounts, roles, and groups
People sign in as themselves, with owner / admin / member / viewer roles governing what they can do. A document can be narrowed further to a named group, so 'the finance team' means the finance team. Removing someone's membership ends their live sessions immediately — the membership is the authority, not the cookie.
A link per recipient, revocable one at a time
A share link can carry the name you gave it — the client, the person, the deal — so withdrawing one recipient's access doesn't mean cutting off everyone else and re-sending. Opens are counted against that individual link. What we still don't record is who: no IP address, no browser fingerprint, no per-visitor identifier. And a share link is a bearer link, so an open tells you the link was used, never that a particular person used it — we say so in the product rather than letting the label imply otherwise.
Who may hand a document to an outsider is its own permission
Being able to write a document and being able to publish it outside your organisation are separate rights here. A workspace can let people author freely while limiting share links and embeds to admins and owners. Activity views obey the same rules as the documents themselves: a timeline or an analytics view never shows a document — or even its title — to someone who could not open it.
Your content never executes on our servers
Published pages are static files served under a strict Content Security Policy. A page may run its own code in the visitor's browser and may reach exactly one network destination — its own dataset — and nothing else. We never execute customer content server-side, so there is no sandbox to escape.
Actions are recorded, and you can export the record
Publishing, sharing, revoking, permission changes, and sign-ins are written to an append-only audit trail, retained for 400 days and exportable as CSV by your administrators. Administrators can also see every share link currently live across the workspace and revoke any of them in one click.
Encryption, and where your files live
Everything is served over TLS. Files are stored in Cloudflare R2 and metadata in Cloudflare D1, both encrypted at rest by the platform. Profusia stores no third-party credentials of yours — we never ask for, receive, or hold your Google, Microsoft, or other service passwords or tokens.
What we don't claim
A security page that lists only strengths tells you nothing, because every security page lists only strengths. Here is the other half.
No SOC 2, ISO 27001, or HIPAA attestation
None are in progress. This is a deliberate scoping choice for a product at this stage, not an oversight: the technical controls above are built and real, and formal certification follows a business reason to hold it rather than preceding one. If your procurement process requires a report, tell us — that is exactly the business reason.
No formal third-party penetration test
We publish a security contact and welcome reports from researchers, but we have not commissioned an independent pentest and do not claim one.
Isolation is logical, not physical
Customers share infrastructure, separated in software — the same model used by most multi-tenant SaaS. A small number of regulated industries specifically require physically separate infrastructure per customer; we do not offer that today.
No dedicated security officer or formal incident-response plan
The organizational process side of a compliance program does not exist yet, as distinct from the technical controls above, which do.
Reporting something
If you believe you have found a vulnerability, please tell us — we would much rather hear it from you. Contact details are published at /.well-known/security.txt per RFC 9116. We do not currently run a paid bounty program, and we will not pursue researchers who report in good faith.