Data Security & Compliance

This page explains how Find AI Now protects data across our platform lifecycle. It covers security controls, compliance posture, third-party vendors, incident response, and your responsibilities. For privacy details and controller roles, see our Privacy Policy.

• • Security ownership by leadership with defined roles across engineering, product, and operations
• • Written policies for information security, access control, vendor management, incident response, acceptable use
• • Policy review at least every 6 months
• • Staff and contractors sign confidentiality and IP assignment agreements and complete security training

We use modern cloud infrastructure and managed services. Typical components include Vercel for hosting and edge, Supabase for Postgres and auth, and Redis or Upstash for caching and queues. Current subprocessors and regions are listed on our Data Transfers page.

• • Isolated prod, staging, and dev environments
• • Least-privilege service and database access
• • WAF, rate limiting, and DDoS protections from our hosting stack

• • TLS 1.3 in transit
• • AES-256 or provider-equivalent encryption at rest
• • Secrets stored in environment vaults or cloud KMS
• • Credential rotation on schedule and on personnel changes

• • MFA for administrative and production access
• • RBAC with quarterly access reviews
• • Optional SSO for enterprise teams
• • Secure, HTTP-only cookies and short-lived tokens

• • Mandatory code review on all changes and protected main branches
• • Dependency, container, SAST, and secret scanning in CI
• • Version pinning and regular dependency updates
• • Security checklists in PR templates

• • Classification tiers: public, internal, confidential, restricted
• • Retention aligned to the Privacy Policy
• • Deletion and de-identification on request and at end of need

• • Encrypted automated backups with periodic restore tests
• • Point-in-time recovery for primary databases where supported
• • Targets: RPO 24 hours or less; RTO 24 hours or less for core platform components
• • SLA details live on our pricing and SLA page

• • Centralised application, auth, and audit logs
• • 24×7 automated monitoring and alerting for availability and security signals
• • Logging of admin actions and configuration changes with regular review

• • Continuous dependency scanning with defined patch windows
• • Monthly vulnerability assessments and immediate triage for critical issues
• • Independent penetration testing twice per year with tracked remediation
• • Coordinated disclosure program in section 14

Our plan defines roles, runbooks, communication, and post-mortems.

Target timelines

• • Detection and triage: under 60 minutes
• • Containment and assessment: under 4 hours
• • User notice (when required): without undue delay once impact is confirmed
• • Regulator notice: within 72 hours where required by law

Where an eligible data breach occurs under Australia's Notifiable Data Breaches (NDB) scheme, we will notify affected individuals and the OAIC as soon as practicable, consistent with legal requirements.

We will inform affected users via in-product notices or email if an incident materially affects their data.

• • Vendor reviews, contractual controls, and periodic reassessment
• • Standard Contractual Clauses or equivalent safeguards for cross-border transfers
• • For transfers between the EU and the UK we use the EU Standard Contractual Clauses and, where required, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
• • Our current subprocessors, purposes, and regions are listed on the Data Transfers page (linked in the footer).

Targets are goals, not attestations, until certification is complete.

If you discover a security vulnerability, email privacy@findainow.com. Do not publicly disclose before we confirm a fix. Acting in good faith under this policy will not be treated as unauthorised access or a breach of our Terms.

Include steps to reproduce, impacted URLs or endpoints, and proof of concept if safe to share. We aim to acknowledge within 24 hours.

We require compliance with our Terms of Service and Acceptable Use standards, including:

• • No tools that promote illegal, harmful, or discriminatory content
• • Clear disclosure of AI-generated content where relevant
• • Respect for intellectual property, privacy, and data rights

We may edit, de-list, or disable listings or integrations that breach these standards.

Security is shared. You agree to:

• • Use strong unique passwords and enable MFA where available
• • Keep account details current and manage staff offboarding promptly
• • Limit access to authorised users
• • Avoid sending unnecessary personal or sensitive data in messages or uploads
• • Use the Platform Invoice Button and avoid external payment links, per the Commission Terms

• • Uptime and performance targets are on our SLA page
• • During major incidents we will provide status updates on our status page or by email

We review this page at least every 6 months and after material changes to our posture. Material updates are posted here and may be emailed to registered users.

Security and privacy: privacy@findainow.com