Is Formius invite-only?
Yes. Organisation creation is invite-gated / design-partner. We are not running open public self-serve signup as a mainstream product surface.
How is tenant data isolated?
Multi-tenant Postgres with organisation membership checks and Row Level Security (RLS), plus server-side org scoping on privileged APIs. Portal access uses token grants scoped to the intended client/document.
Do you require MFA?
Yes for owners, admins, and platform console operators (Supabase TOTP / AAL2). Staff MFA is optional. Enroll under Profile → Two-factor authentication.
How are passwords protected?
Authentication is via Supabase Auth (hashed credentials). Leaked-password protection (HaveIBeenPwned) is part of the minimum-standard hardening checklist for production Auth config.
What about rate limiting and abuse?
API rate limits use a shared store (Upstash Redis when configured) with separate budgets for human vs AI traffic. Portal document HTML is sanitised; portal routes enforce Content Security Policy.
Where is data hosted?
Application on Vercel; primary data plane on Supabase. See Subprocessors for the current list.
Do you have a Privacy Policy, Terms, and DPA?
Yes — Privacy, Platform Terms, and a DPA schedule template for Atlas / design partners (execute with counsel). Ask support@formius.io for the signed pack.
Can Formius analyse our performance metrics?
Yes, when authorised under the design-partner DPA (Schedule A — Platform performance permissioning). Design partners instruct Formius to analyse operational and commercial metrics from platform use — for example close rates, average revenue, pipeline conversion, cycle times, and similar indicators — for:
- Organisation performance — Customer reporting and Formius success/support for that organisation;
- Platform performance — product improvement and reliability (prefer aggregated / de-identified where practicable);
- Industry performance — benchmarks built only from aggregated, de-identified metrics (Formius does not sell customer personal information as a business model; no re-identification of clients).
Customer data is processed for analytics only within the purposes and instructions established by the applicable customer agreement and DPA. Formius does not use customer content to train public or generally available foundation models unless separately and expressly agreed in writing. Optional AI inference via a configured provider is distinct from model training. Full schedule: docs/legal/FORMIUS_PLATFORM_PERFORMANCE_PERMISSIONING_V1.md.
Are you SOC 2 or ISO 27001 certified?
No. Formius does not claim SOC 2 or ISO 27001 certification, independent privacy certification, or verified compliance with every applicable privacy law. Attestation programmes are out of scope until buyers require them and the control programme exists.
How do I report a security issue?
Email support@formius.io with enough detail to reproduce. Do not include live secrets or production tokens in the report body if they can be rotated first.
More detail
Canonical design-partner FAQ: /faq · Markdown for agents: /faq.md · LLM index: /llms.txt. Internal engineering model: docs/architecture/SECURITY_MODEL.md (repo). Public legal pages: /privacy, /terms, /subprocessors.