Trust
Where your records are, and who can reach them.
What a security review asks first: where the code runs, who handles the data for FourWinds, how a sign-in is checked, how a change is approved and kept, and how the service is doing now.
Where it runs
In Ireland
The app's code runs in Vercel's Dublin region, pinned in its settings, and the database is in Supabase's eu-west-1 region, in Ireland.
Each organisation on its own
The database keeps each organisation's records apart: one organisation's session cannot read another's rows.
Backups apart from the database
Every night each organisation's records are copied and read back to check, and kept away from the database: the last 35 nights and the first of each month for a year.
Who handles data for FourWinds
Every outside service the software calls, with what each handles. The list is read from the code: a supplier the code stops calling comes off it.
| Supplier | What it handles |
|---|---|
| Vercel | Hosts the site and the app, and runs the app's code in its Dublin region. |
| Supabase | Hosts the database that holds each organisation's records, in eu-west-1 (Ireland). |
| Vercel Blob | Keeps the nightly backups, sealed, away from the database. |
| Resend | Sends the app's emails once sending is switched on: invitations, alerts and the weekly report. |
| Anthropic | Runs Claude for Ask, only for an organisation whose admin switches it on. |
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyWhere your data goes
Each place a customer's data goes: where it runs, what it touches, and whether it leaves the EU. Every line was checked against the hosted service's live settings, and the record of each check is kept with the code.
The app and its scheduled jobs
Leaves the EU: No- Where it runs
- Vercel Functions, in Vercel's Dublin region (dub1). The twelve scheduled jobs run there too.
- What it touches
- Everything the app shows or works on, while a request or a job runs. Nothing is kept there between requests.
- Leaves the EU
- The code is pinned to Dublin in the deployment's settings.
Vercel's edge network
Leaves the EU: It can- Where it runs
- The Vercel edge location nearest the person using the app.
- What it touches
- Requests pass through it on their way to Dublin. A signed-in page is sent marked private and no-store, and the edge keeps no copy of it. Only the public site's pages are cached there.
- Leaves the EU
- A request enters at the edge nearest the person, which is outside the EU only when they are.
The database
Leaves the EU: No- Where it runs
- Supabase, in its eu-west-1 region (Ireland).
- What it touches
- Every record of every organisation, each kept apart by row-level security.
- Leaves the EU
- The project is in eu-west-1, as read from Supabase.
Backups and ledger checkpoints
Leaves the EU: No- Where it runs
- A Vercel Blob store in Dublin (dub1), apart from the database.
- What it touches
- A full copy of each organisation's records every night, sealed with the deployment's key before it is stored, and a copy of each signed ledger checkpoint.
- Leaves the EU
- The store's region is Dublin, as read from Vercel.
Timestamps on the ledger
Leaves the EU: No- Where it runs
- DigiCert's timestamp authority (timestamp.digicert.com, RFC 3161), asked once a night for each signed ledger checkpoint.
- What it touches
- No customer data. Only a sha256 of the checkpoint's text is sent. The signed reply is kept with the checkpoint, and anyone can check it with openssl.
- Leaves the EU
- No customer data goes to it: a sha256 cannot be turned back into the text it was taken from.
Logs
Leaves the EU: It can- Where it runs
- Vercel's runtime logs, kept for up to 30 days. No log drain sends them anywhere else.
- What it touches
- Each request's path and status, and what the app writes: failures and the time each job took. An unexpected error is written with its message, which can include a value it was working on.
- Leaves the EU
- Vercel names no region for its logs.
- Their terms
- Vercel: Runtime Logs, limits
Email
Leaves the EU: It can- Where it runs
- Resend, from the fourwinds.ie domain, set up in Resend's eu-west-1 region (Ireland).
- What it touches
- The recipient's address, the subject and the message: invitations, password resets, alerts and the weekly report.
- Leaves the EU
- Mail goes out from eu-west-1. Resend is a US company that takes part in the EU-US Data Privacy Framework, the transfer basis the DPA names. Until sending is switched on, the app sends no email at all.Now: sending is switched on.
AI (Ask)
Leaves the EU: Yes- Where it runs
- Anthropic's API, running Claude. Anthropic stores API data in the US, its only storage region, and by default may run the model in any region.
- What it touches
- For Ask, the question and the records its read-only tools return; Ask keeps the questions and answers here, where an erasure reaches them. Anthropic deletes API inputs and outputs within 30 days, keeps them longer only if flagged for misuse (up to 2 years) or sent as feedback, and does not train on them by default.
- Leaves the EU
- Only for an organisation whose admin switches AI on. It starts off for every organisation. AI steps in workflows are coming, once the terms cover them.
- Their terms
- Anthropic: how long API data is kept (updated 1 July 2026)Anthropic: model training (updated 18 August 2026)Anthropic: data residency
Your connected systems
Leaves the EU: It can- Where it runs
- Each vendor's own service, wherever your account with it is.
- What it touches
- What each connection reads, as the coverage page lists it. The app asks for read access only, unless an admin grants write to a system that supports it. The sign-in tokens are sealed with AES-256-GCM before they are stored, under a key kept outside the database.
- Leaves the EU
- It stays wherever your account is hosted. An account hosted in the US, such as HubSpot's, is flagged as a transfer out of the EU.
The ledger signing key
Leaves the EU: No- Where it runs
- A setting of the app's deployment, held apart from the database.
- What it touches
- No customer data. It signs the head of each organisation's check ledger each night; the public half is published at /verify.
- Leaves the EU
- It holds no customer data to leave.
Who at FourWinds can see your records
FourWinds' owner can view your records, read-only
FourWinds' owner can open your organisation as your admin sees it, after their own sign-in and two-step code, with a reason that goes on your audit trail. Nothing can be changed during a view: the database refuses every change. Sales staff and partners cannot do this, and nobody at FourWinds can sign in as one of your people.
Working inside your organisation
Only your admin can let someone at FourWinds change anything: your admin invites or adds them in People, like anyone else. Each step is written to your audit trail, and your admin can give their access an end date, at most a year away. After that day they cannot sign in to it.
Opened for your admin
FourWinds opens your organisation for the admin you name, who is its first member and chooses their own password. Nobody at FourWinds becomes a member when it opens, the owner included.
Every view is on your audit trail
Each view by FourWinds' owner is written to your audit trail: when it started and why, every page opened, and when it ended. Nobody can edit the trail. Your admin sees each visit with its dates in Settings, under People.
Under the app
The backup's login reads every organisation and can change nothing. A check result changed underneath the app, even with the database owner's login, breaks the ledger's chain.
Want this on your own systems? It starts with an audit of how your business really runs.
Book an auditCutting access
Disconnect a system
Disconnecting revokes the app's access at the vendor where the vendor allows it, deletes the sealed sign-in, and can erase what was copied. Where a vendor gives only a key, the app says to delete it there too.
Remove a person
Removing someone ends their membership and every session they had in that organisation at once.
Revoke an API key
A revoked API key is refused from its next call.
Switch AI off
An admin switches AI off in Admin, and from then Eurus stops calling Anthropic for that organisation.
Sign-in and approval
Two-step sign-in
A password alone opens nothing for FourWinds' own people: the code from an authenticator app is asked every time, and each code works once.
Four eyes
A fix to access, money or customer data cannot close without a named approver, and a workflow's approval step waits for a person in the role it names.
Keys sealed
The keys to your systems are sealed before they are stored, and can be rotated.
Want this on your own systems? It starts with an audit of how your business really runs.
Book an auditEvery change, kept
An append-only trail
Each organisation's audit trail is numbered and chained: the app can add a line and read it, never change or delete one, and a change made underneath is found.
Everything, to take elsewhere
An organisation can take every record it holds here as one file, each table with its fingerprint, and no secret in it.
Erased everywhere
A person erased on request is erased from every table that held them, and the ledger's fingerprints still check.
A tamper-evident ledger
Every check result is chained to the one before it, and the chain checks out with code that runs outside the database.
The service, now
Read as this page was built: whether the database answers, and when the last backup finished.
Your data: what is read, kept and erased
- The database
- Reachable
- Last backup
- Mon, 9 Nov, 03:00
- Checked
- Mon, 9 Nov, 10:13
Start here
See it on a business of your own.
Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.