Security

FounderTally runs on Cloudflare's global network. Cloudflare maintains independent certifications including SOC 2 Type II and ISO 27001 (see Cloudflare's Trust Hub).

Those certifications are Cloudflare's, for its platform. FounderTally itself has not been audited or certified.

• The keys and sign-in tokens of the services you connect are encrypted with AES-256-GCM under a key that belongs to your account alone.
• That account key is itself encrypted by a master key that only the storage service holds. The part of the app that draws your pages never holds the master key and never receives your keys in plain text.
• Once saved, a key is never shown again, and disconnecting a service deletes it.

They are never stored. Every page and every report reads them live from your connected services, holds them in memory for that one answer, and drops them.

• Sign in with a link by email that works once, for 15 minutes, only in the browser that asked for it, or with Google or GitHub where they are offered (only a verified email address counts).
• Sign-in links are rate limited: per address in our store, and per IP address by Cloudflare at the edge (we do not store the IP address). When it is switched on, Cloudflare Turnstile also checks the form is used by a person.
• Your session lasts 7 days unused and 30 days at most. Its cookie is hidden from scripts and works only on foundertally.com, and we keep only a hash of its secret. Signing out, or being removed from an account, ends it at once.

Each account has its own database. Every request is checked against that account's own member records and the member's role, so one account can never read another's data. An audit log records who connected or removed a service and who invited, changed or removed a member.

HTTPS only, with HSTS. A strict content security policy runs only the app's own scripts, no other site may frame FounderTally, and changes are accepted only from FounderTally's own pages.

Found a security issue? Write to support@foundertally.com. Please do not test against other people's accounts. How we handle your data is in the privacy notice.