Security and privacy

The application runs in the Paris region (Vercel, cdg1). The database, authentication and files are hosted in the Paris region (Supabase, eu-west-3). Data at rest stays in the European Union (EU); the hosting provider’s delivery network is global.

Fuzain never connects to your clients’ data: mockups only use generated fictitious data. For each task, AI models receive the working texts they need: brief, imported specifications, mockup specification, reviewer comments (to classify them). Calls go through OpenRouter, restricted to providers with zero data retention and no training on your content; Fuzain only logs metadata (task, model, cost).

Vercel (application hosting, Paris), Supabase (database and authentication, Paris), Resend (email, EU region), Stripe (payment), OpenRouter and AI model providers. Planned but not enabled to date: Sentry (error monitoring, EU, personal data filtered) and PostHog (service usage measurement, EU); their activation will be announced here and in the privacy policy. Transfers outside the EU may occur to companies established outside the Union and to model providers: they are covered by the European Commission’s standard contractual clauses.

Strict isolation between organisations through row-level security (RLS) policies in the database, checked by automated tests. Passwordless sign-in: single-use link and 6-digit code sent by email, or Google or Microsoft single sign-on (SSO). Share links use random tokens of which only the hash is stored, and can be revoked at any time. Strict content security policy (CSP) with a unique value on every page load (nonce), encrypted connections enforced in the browser (HSTS) and protection against framing.

For your project content, Fuzain acts as a processor (Article 28 of the General Data Protection Regulation, GDPR): a data processing agreement (DPA) is signed on request. Report usage measurements in production are pseudonymised by default.

During your subscription, you can export all your content: Power BI project (PBIP) of every version, specifications in JSON (an open data format), feedback, acceptance reports and audit log. In read-only mode (end of trial or subscription), the JSON archive of your data and the acceptance reports remain downloadable. Should the service be discontinued, we contractually commit to 6 months’ notice so you can retrieve everything, followed by certified deletion of your data.

Daily database backups and point-in-time recovery (PITR) are being enabled. Targets once in place: at most one hour of data loss (RPO ≤ 1 h) and recovery within 4 hours (RTO ≤ 4 h).

To report a vulnerability, or to request the DPA and our security questionnaire: securite@fuzain.ai.