Folio AI · Security & trust
Careful with what you know. By design.
Folio AI is built around a simple idea: chat should only ever answer from knowledge you've approved for the people asking. Here's how we keep it that way.
One chat, or two if you need it
A customer chat as standard. A protected chat if you need one.
Most businesses start with a single customer chat on their website — and for many, that's all they need. If you also have technical, internal or commercially sensitive knowledge your team relies on, we can add a second, protected chat just for them. It's only built if you need it.
Where you have both, they are built separately and stored in separate databases, so the customer chat can never answer from your private material. We'll work with you to decide what yours requires.
On your website · For your customers
Customer chat
StandardAnswers questions from the material you approve for the public — manuals, specification sheets, catalogues, FAQs — in your branding, with its sources on show.
- Product manuals
- Specification sheets
- Catalogues
- Public FAQs
Open to visitors, with usage limits
Behind sign-in · For your team
Protected chat
If you need itAnswers from the technical, internal and commercially sensitive knowledge your staff rely on — available only to the people you authorise.
- Service procedures
- Engineering notes
- Internal guidance
- Commercial detail
Only people you authorise can sign in
- 01
Separate where it matters
If you have a protected chat, its knowledge lives in its own database — not one database with a permissions flag.
- 02
No route between them
The customer chat is only ever connected to its own database. However a question is phrased, it has nothing private to draw on.
- 03
We draw the line together
Some businesses need both chats, many need just one. We work with you to decide what's public, what's private and what's really required — and you approve it before anything goes live.
Where your data lives
One secure home. Nowhere else.
We treat your documents with care from the moment you share them. Everything is stored in our secure database, hosted by Supabase — and once your implementation is complete, that's the only place your data is held. No stray copies on laptops, in inboxes or in shared drives.
Supabase is one of the world's leading database platforms, relied on by businesses from start-ups to large enterprises — built on technology that has quietly powered banks, governments and global companies for decades.
Checked by independent auditors
Supabase's security is regularly reviewed by an outside firm, not just taken on trust.
Locked away at all times
Your data is encrypted while it's stored and while it travels, so it can't be read if intercepted.
Proven technology
Built on the same database technology some of the world's largest organisations rely on.
Held in one place
After implementation, your knowledge is kept in this database and nowhere else.
The technical detail
- Compliance
- Supabase is SOC 2 Type 2 compliant.
- Encryption at rest
- AES-256.
- Encryption in transit
- TLS.
- Database
- PostgreSQL, managed by Supabase.
- Credentials
- Database and model keys are held server-side and never reach the browser.
As published by Supabase at supabase.com/security.
The principles
Approved sources only
Answers come from a closed knowledge base built from the material you approve — not the open web.
Sources on show
Every answer references the documentation it used, so it can be checked.
Cautious by design
Uncertainty is stated, and missing evidence leads to a hand-over, not a guess.
Separated, per customer
Each customer has their own isolated environment, with protected knowledge kept in a separate database wherever it's needed.
Keys stay server-side
Model and database credentials never reach the browser.
Clearly AI
People are told they're talking to AI, and that answers should be checked for anything critical.
How data is handled
- Your documents
- Used only to build and run your chat. We agree with you what's included, and what's public or protected.
- Where it's kept
- In our secure database, hosted by Supabase. Once your implementation is complete, that's the only place your data is held — working copies used during setup are deleted.
- Questions and answers
- Logged so answers can be reviewed, flagged and improved. Retention for customer deployments is agreed with each customer; questions asked in our public demo are deleted after 90 days.
- People using the chat
- The public chat doesn't need an account. To prevent abuse it applies usage limits, identifying repeat visitors by a one-way hash of their IP address rather than cookies.
- This website
- Cookie-free visitor statistics from Vercel Web Analytics, so we can see which pages are read. No advertising trackers and no cookies.
Who we rely on
Folio AI is a managed product built on established infrastructure. These are the services that process data on our behalf:
- OpenAIGenerates answers, and the search index of your documents, from the passages retrieved for each question.
- SupabaseHosts our secure database, which holds each customer's knowledge and chat logs.
- VercelHosts the Folio AI website and chat applications, and provides cookie-free visitor statistics.
- ResendDelivers enquiries sent through our contact form to our inbox.
We don't claim certifications we don't hold. If you're running a security or procurement review, we're happy to answer your questions in detail.
Ask us anything