Read-only by design
Fallow requests minimum read scopes. It never deprovisions users or changes permissions in MVP.
Security
Customer data should stay customer data.
Fallow is designed to minimise what it collects, isolate every workspace and prevent support or engineering operators from reading tenant user data.
Private by architecture
Raw scan data stays in encrypted regional blob storage and never enters Postgres.
Scoped to your workspace
Every request is authenticated, workspace-scoped and protected by central plan gates.
No operator visibility
Support and engineering tooling expose metadata only—never your customer user data.
Data path
Encrypt early. Expose less. Expire automatically.
Sensitive source data is envelope-encrypted before storage. Postgres receives derived metrics and tenant-salted PII hashes—not raw API responses.
01Read-only APIMinimum scopes
02EncryptTenant data key
03DeriveMetrics + hashes
04Expire30–90 day TTL
Controls
Security choices that reduce the blast radius.
Fallow does not rely on a privacy policy alone. Its architecture removes common paths to accidental customer-data exposure. Security controls described here include target architecture and are not all generally available yet.
Regional storage
Regional database, encrypted storage and key management are launch requirements. The replacement infrastructure must be verified before hosted access resumes.
Per-tenant keys
The target architecture uses a separate workspace key to wrap short-lived data encryption keys. Replacement key management is being validated.
Signed downloads
Every report link is scoped to one file and one user, then expires after 15 minutes.
Tamper-evident history
Append-only audit events form a SHA-256 hash chain; updates and deletes are rejected.
No secrets in telemetry
Logging and error reporting scrub credentials, tokens and customer PII before events leave the process.
Find the fallow seats
Review access without widening access to your review data.
Join the private preview. The security controls described on this site include target architecture and are not all generally available yet.