Security

How FFP One handles your data, and how to tell us about a security problem.

How your data is handled

• Stored in the US. Your account, chats, Research Reports, notes and memos are stored in the US, with Supabase (on AWS) and Google Cloud. The database is copied every six hours, and each copy is kept for 30 days.
• Checked on every request. Your work is tied to your account. Your browser never reads the database directly: every request goes through FFP One's server, which checks it against your account.
• The AI models. Chat and memos run on Anthropic's Claude. For a Research Report you choose the model: Claude, OpenAI's GPT, or DeepSeek or GLM, which are made by China-based companies. FFP One calls each provider's own service directly, with no middleman. For how DeepSeek and GLM handle what they receive, see the DeepSeek privacy policy and the Z.ai (GLM) privacy policy. FFP One doesn't use your content to train AI models.
• Sign-in. New accounts sign up with Google or a one-time link sent to their email, so there's no new password to leak.
• Payments. Card payments go through Stripe's own checkout page, so FFP One never sees your full card number.
• Your data, on request. To get a copy of your data or have it deleted, see the privacy notice, which also lists every provider that receives personal data.

Report a security problem

Found a security problem on ffp.one or app.ffp.one? Email security@ffp.one. Tell us what you found, where, and how to reproduce it, and please keep it private until we've fixed it.

We'll reply within 3 business days and let you know when it's fixed. We don't run a bug bounty.

Please test only with your own account, and don't access other people's data or slow the service down for others.

Last updated: October 2026