Data residency
Australian data residency remains a launch requirement. The replacement hosting and storage services must be verified before hosted onboarding resumes.
Trust centre
The detail behind our security claims.
A public summary of how Fallow handles tenant data, isolates workspaces and limits internal access. Formal assurance documents will be published here as they become available.
AU
Australia is the target launch data region.
1:1Target tenant-to-key isolation
15mReport link expiry
30–90dRaw scan retention
Contact expectation
Security requests have a clear response target.
Security requests route to the Fallow security owner, who aims to acknowledge them within two business days. Please do not send credentials, secrets, exports or customer user data.
Architecture
Controls that are difficult to bypass.
Security-sensitive choices are centralised in the product architecture rather than left to individual routes or support procedures. The controls described here include target architecture and are not all generally available yet.
Per-tenant encryption
The target architecture uses envelope encryption with tenant data keys wrapped by a separate workspace key. Replacement key management is being validated before hosted access resumes.
Data minimisation
Raw API responses never enter Postgres. Postgres stores derived metrics and tenant-salted hashes where possible.
Operator boundaries
Support and engineering tooling expose workspace metadata only. Fallow has no tenant impersonation mode.
Tamper evidence
Audit events are append-only and linked by a SHA-256 hash chain. Updates and deletes are rejected by database triggers.
Controlled egress
Reports are encrypted at rest and served only through signed, single-file URLs with a 15-minute expiry.
Sub-processors
A short, intentional list.
The public website is moving to Sites, with Cloudflare services and Neon retained. Hosted application infrastructure is being migrated; the final provider list will be verified before onboarding resumes.
OpenAI Sites
Public website hosting; no customer scan data is stored on the marketing website.
Neon
Regional serverless Postgres for application and audit metadata.
Stripe
Planned payment and tax provider for a future commercial launch; not enabled for the current private preview.
Resend
Transactional service email.
Cloudflare
DNS, waitlist and delivery services; application hosting migration is in progress.
Find the fallow seats
Reviewing Fallow for a vendor assessment?
Read the security overview and ask a question. The capabilities and controls described in this trust centre include target architecture and are not all generally available yet.