Legal

Security

Last reviewed 1 October 2026Version 0.1 · draft

Draft for review · not yet publishedEvery statement below was true of the running system on 1 October 2026. It goes live the same day as the privacy policy, once the amber notes are resolved.

Fidell works through your inbox, so how it protects your data matters more than anything else we build. This page sets out what is in place today, what is not done yet, and how to report a problem.

Google’s assessment and Microsoft’s verification

Google requires every app that reads Gmail to pass an independent security assessment, called CASA, and to repeat it every year. Fidell has not been assessed yet. We are preparing for it, and this page will give the date when it is complete.

Until Google has verified Fidell, Google’s own screen may warn you that the app is unverified when you connect. That is expected until Google’s review is complete.

Microsoft has no equivalent assessment for apps like Fidell. Instead it checks that a real, registered business stands behind an app, and marks the app as a verified publisher on its approval screen. Fidell’s verification is not complete yet.

Decision · CASA wording (#33 · #34)Correct while no assessor is engaged. Once one is: “Fidell’s first assessment is under way. It is not complete, and Fidell does not yet hold the Letter of Validation Google issues at the end.” After the letter, replace this section with: “Fidell’s handling of Gmail data is independently assessed against Google’s security requirements every year. The most recent assessment was completed on [DATE].”

Where your data is kept

Your account, your documents, your quotes and the mail Fidell reads are stored in Australia, on Amazon Web Services in Sydney. One thing leaves Australia: the text of the tender documents you upload and of the quotes you receive, which our AI provider reads in the United States.

Encryption

In transit. Every connection to Fidell is encrypted, using TLS 1.3 where your browser supports it, and older, weaker versions are refused. Browsers are told to use Fidell only over HTTPS. Fidell’s own connections to Google, Microsoft and to its AI provider are encrypted too.
At rest. The storage that holds Fidell’s database, files and backups is encrypted.
Your Google and Microsoft credentials are encrypted a second time, with AES-256-GCM, using a key kept outside the database. A copy of the database on its own cannot be used to reach your mailbox.

Each business’s data is kept apart

The database itself enforces the boundary between businesses. Every table holding your data returns only your business’s rows, and a request that does not say whose data it is for fails rather than returning everything.

We test this against a real database on every change to Fidell and every night. On 29 September 2026 we also signed in to a running copy of Fidell as one test business and tried to reach another’s projects, tender documents and quotes. All fourteen attempts were refused.

Inside your business, each person connects their own mailbox. Colleagues see the mail Fidell files to the projects they work on, and nothing else: no one can open or search a colleague’s inbox.

What can be reached from the internet

Only Fidell’s website and application, over HTTPS. The database and job queue accept no connections from outside the server.
Administrative access is by SSH key only, with password login switched off.
Sign-in cookies cannot be read by page scripts and travel only over HTTPS. We store only a one-way hash of each session, so a copy of our database contains no usable sign-in.
Every page carries browser security headers, including ones that stop other sites from framing Fidell.

How Fidell is built and checked

Every change, and the whole codebase every night, is scanned for security flaws in our own code and for known vulnerabilities in the software we depend on. A high-severity finding stops a change from being merged, and a failing nightly scan opens a tracked issue.
We are alerted to vulnerable dependencies and offered fixes automatically.
Every change is reviewed before it is merged.
On 29 September 2026 we ran an authenticated scan of a running copy of Fidell (OWASP ZAP), alongside the cross-business test above. It recorded no failures; the lower-risk warnings it raised are fixed or tracked.

Decision · merge enforcementThe main ruleset requires the security checks and one approving review, but carries a repository-role bypass in “always” mode, so “stops a change from being merged” and “every change is reviewed” are the default rather than a guarantee. Narrow the bypass, or soften those two lines to describe the practice.

Our test environments

The versions of Fidell we test changes on never hold the content of your mail or any credential for your Google account. Both are stripped out, and every refresh of a test copy is checked automatically — nine checks — and fails if anything slipped through. Test versions use a different encryption key, cannot connect to Google as you, and cannot reach our AI provider.

Decision · #29 contacts in test copiesContacts derived from mail stay in test copies (“keep, for now”, 28 Sep 2026). This section’s wording is exact — never broaden it to “no customer data”. Before any customer’s data is in production, limit the copy to the founders’ workspace or pseudonymise contacts.

AI

Fidell uses one AI provider, Anthropic, to read the tender documents you upload and the quotes that arrive in your inbox, so they can be compared against your scope. It never receives the rest of your mail, your contacts, your calendar or your files.Anthropic’s commercial terms prohibit it from training its models on what we send, and Fidell does not train AI models on your data.

Decision · AI locationConfirm Anthropic’s processing location before this page says “United States” anywhere: no inference_geo is set, so inference runs where the workspace default points. Pin it, or check the Console.

Your mailbox stays yours

Fidell holds two Gmail permissions: to read your mail, and to write drafts and send them. It cannot delete, move or re-label the mail in your inbox, or change your Gmail settings; Google does not give it those permissions.
On Microsoft 365 and Outlook, Fidell holds permission to read and write your mail and to send it. Microsoft bundles deleting into the read-write permission, so Fidell blocks it in its own code: there is no function that deletes mail or moves it to Deleted Items, and an automated test stops any change that adds one.
The calendar and file permissions would also let an app delete. Fidell never deletes a calendar event or a file.
Nothing is sent without you pressing send. Mail Fidell sends goes out through your own Google or Microsoft account, exactly as if you had sent it yourself.
Before Fidell reads your inbox you can name senders and subject words to skip, and Fidell never opens or keeps mail that matches them.
You can withdraw Fidell’s access at any time in your Google or Microsoft account. Access stops at once, and the credentials we held are destroyed rather than kept. Withdrawing access stops Fidell reading new mail; it does not erase what was already collected (see “Deleting your data”).

Who at Fidell can see your data

Decision · #41 human accessLeave this section’s claim out until #41 ships. When it does: “People at Fidell do not read your mail. Access to stored mail is limited to [ROLE], given only for a stated reason, for a limited time, and logged.” If the page must go live first, the honest version is: “Two people run Fidell and are the only ones with access to its servers. Access to stored mail is not yet separately logged; that control is being built.” Privacy section 3.5 has the same gate.

Service providers

Five companies handle your data so Fidell can run: Amazon Web Services (hosting, in Sydney), Google (sign-in and the Gmail access you grant), Microsoft (sign-in and the mailbox access you grant), Anthropic (reading the tender documents you upload and the quotes you receive) and Stripe (card payments). What each receives, and where, is in our privacy policy. We email account holders before a new provider starts handling your data. Pilot applications, call bookings and our phone line run through HighLevel, which never receives anything from your mailbox.

Deleting your data

Email support@fidell.ai to have your data deleted. We delete it within [N] days, and it leaves our backups in about a week after that. What happens when you close your account is in our terms.

What we don’t have yet

SOC 2 or ISO 27001. Fidell holds neither. If your business needs one before it can use Fidell, tell us — it helps us decide when to start.
Google’s CASA assessment. See the top of this page.
An independent penetration test. Not yet. The testing described here is our own.
A paid bug bounty. None, but we want your report.

Report a security issue

If you think you have found a security problem in Fidell, email support@fidell.ai. Tell us what you found and how to reproduce it. We will acknowledge your report within two business days and keep you updated while we fix it.

If you act in good faith, we will not take action against you. Good faith means you test only against accounts you own; do not access, change or keep anyone else’s data — if you come across some, stop and tell us; do not disrupt the service; and give us reasonable time to fix the problem before you talk about it publicly. This matches section 11 of our terms. Our security contact is also published at fidell.ai/.well-known/security.txt.

Decision · security contact · lawyerReports go to support@fidell.ai until a security@fidell.ai Workspace group exists and a test message to it arrives; then switch this page, terms section 11 and security.txt together. Lawyer to confirm the good-faith safe-harbour wording.

Fidell’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.