Security

Forseeno reads your business apps so it can warn you early. Here is exactly how we protect that access.

Read-only access

Forseeno asks each app for read-only permission. It cannot move money, pay bills, or create or change anything in your books, store or Stripe account.

Encrypted keys and connections

The keys that let Forseeno read your apps are encrypted before they are stored (Fernet: AES-128 with an HMAC integrity check), on top of the database's own encryption at rest. All traffic uses HTTPS, and browsers are told to always use it (HSTS).

Your data kept separate

Every business's data is isolated in the database with row-level security, so one customer's data can't be read in another customer's session.

You decide who sees what

An advisor sees your summary only while you allow it, and every time they open it is written to your account's security log. Partners who referred you never see your numbers.

Numbers by code, words by AI

Our code calculates every figure. AI only writes the explanation, and each figure in it is checked against the calculation before it is sent. Our AI provider, Anthropic, does not train on data sent through its API.

Disconnect and delete any time

Disconnecting an app deletes the stored keys and, for QuickBooks, Xero and Stripe, also revokes Forseeno's access at the provider. Deleting your account deletes your business data and connections.

Protection against abuse

Rate limits on every endpoint, signed and time-limited links for reports, security headers on every page, and partner sign-in codes that expire after 10 minutes.

Trusted providers

Forseeno runs on established providers, including Supabase (SOC 2 Type 2, ISO 27001), Railway (SOC 2 Type II), Upstash (SOC 2) and Stripe (PCI DSS Level 1). Forseeno itself is a young company and does not yet hold its own SOC 2 report. See the full list of providers.

Report a security issue

Email mehul@forseeno.com. We reply within 2 business days. Please give us a reasonable time to fix an issue before making it public, and don't access other customers' data while testing.