Trust and Security
Honest answers about GDPR compliance, data residency, authentication, payment handling, and who has access to what. No boilerplate. Plain English.
All data processing complies with UK GDPR and the Data Protection Act 2018. We are registered with the ICO. A Data Processing Agreement (DPA) is available on request.
Your data is stored in UK and EU regions only. We do not transfer personal data outside the UK/EEA without standard contractual clauses in place.
All data encrypted in transit with TLS 1.2 or higher. Data at rest encrypted using AES-256. API credentials stored encrypted, never in plain text.
Your data is isolated at the database level using row-level security policies. No customer can access another customer's data, even in the event of an application bug.
Account authentication is handled by Supabase Auth, which uses industry-standard email/password flows with bcrypt hashing. Multi-factor authentication (TOTP) is available and recommended for all accounts.
Admin access to your account requires a separate admin credential set. FatArrow staff access your data only when you have opened a support case and explicitly granted access. All staff access is logged.
API keys for integrations (Xero, Shopify, etc.) are stored encrypted using AES-256 at the infrastructure level. Keys are never logged or exposed in application output.
Subscription billing is handled by Stripe. FatArrow does not store card details on our infrastructure. Card data is tokenised and handled entirely by Stripe, which is PCI DSS Level 1 compliant.
We store only: your Stripe customer ID and subscription status. No card numbers, CVV codes, or expiry dates ever touch our servers.
You can cancel, upgrade, or downgrade your subscription at any time from your dashboard. Billing disputes should be directed to support@fatarrow.io.
Right to Access
Request a copy of all personal data we hold about you. We will respond within 30 days.
Right to Erasure
Request deletion of your account and all associated personal data. Completed within 30 days.
Right to Portability
Export your data in machine-readable format (JSON or CSV) from your account dashboard at any time.
Right to Rectification
Correct inaccurate personal data from your account settings, or contact support@fatarrow.io.
The following third-party services process customer data on FatArrow's behalf. We have Data Processing Agreements in place with each.
For AI processing via Anthropic, we use zero data retention settings. Conversation data is not stored or used for model training.
If you have a security disclosure, compliance question, or need a DPA for your organisation, contact us directly. We respond within 1 business day.
mailsecurity@fatarrow.io