Data & Privacy
Before we see anything, a mutual NDA. After that, only the data your 2–3 agreed workflows actually need — processed by AI that does not train on it, and logged at every step. This page answers the questions we’d want answered if we were the client.
The five questions every owner should ask
🤖 Does the AI train on my data?
No. We use commercial AI APIs (currently OpenAI), not consumer chatbots. Data sent through these business APIs is not used to train the models — that is the providers’ standing commercial policy, and it is the key difference from an employee pasting your client files into free ChatGPT. Your business context stays your business context.
🗄️ Where is my data stored?
On FBE’s servers hosted with Amazon Web Services (United States). All traffic is encrypted in transit (TLS); storage uses AWS-managed encryption; daily backups are retained for seven days and then roll off automatically.
👥 Who can actually see it?
A short list: FBE’s founder-led team, and the subprocessors listed below — nobody else. Access inside the platform is role-based (owners, approvers, members and viewers see only what their role allows), and every access and action — human or AI — is written to an audit log.
🧱 Is my data separated from other clients’?
Yes — logically separated per organisation, enforced by role-based access control and covered by the audit trail. No client can ever see another client’s workspace, and AI agents working for one organisation only receive that organisation’s context.
🚪 What happens when we leave?
Your data remains yours. You can request an export at any time. On written request we delete your data within 30 days, with backups rolling off within seven days after that. If a trial simply expires, data is retained (never sold, never repurposed) until you ask us to delete it.
Data minimisation is built into the offer
Because an engagement automates 2–3 agreed workflows — not “your whole business” — only the data those workflows need ever enters the system. If we automate quoting and monthly reporting, we hold quoting and reporting data. Nothing else is ingested, and adding a workflow is a decision you make, not something that happens to you.
Subprocessors
☁️ Amazon Web Services
Hosting and backups (United States). Encryption in transit and at rest.
🤖 OpenAI
AI processing via commercial API (United States). No training on your data.
📧 Amazon SES
Transactional email delivery (United States).
💳 Fygaro
Payment processing (PCI-DSS). Card details never touch FBE’s servers.
We will notify active clients before adding or changing a subprocessor.
Your agreements
- 🤝 Mutual NDA — signed before you share anything, including during the free assessment.
- 📋 Data Processing Addendum (DPA) — available for every engagement on request; you act as data controller, FBE as processor, with breach notification and deletion obligations in writing.
- 📜 Privacy Policy and AI Use Policy — how the website and the AI itself are governed.
Questions we haven’t answered?
Ask them in the assessment call — privacy questions are never an interruption; they’re the sign of a client we want.