Security and Data

Your data,
locked to you.

Read-only access to your files, encryption everywhere, and a login that can only ever see your own business. Here is how it works.

Read-only Drive access Encrypted in transit and at rest Isolated per client
The short version: We only read the folder you share, keep the results encrypted and separated per client, never sell or share your data, and delete it when you ask.
01

How your data flows

Your sales files stay in your own Google Drive. You share one folder with us, and we only ever read it.

  • Your Google Drive folder. Read-only access. We never edit, move or delete your files, and you can unshare the folder at any time
  • Our servers. Each morning they read the new files, check them and work out your numbers, alerts and forecast
  • Our database. The results are stored encrypted, separated per client, so your portal, briefs and reports can show your history
  • You. Your morning brief arrives on WhatsApp, and your portal shows the same numbers behind your own login
02

Encryption

  • All data in transit is encrypted with TLS 1.2 or higher: between your browser, our servers, our database and our providers
  • Your business data is encrypted at rest in our database
  • Passwords are stored only in hashed form by our login provider and are never visible to us
  • API keys and credentials live in encrypted environment settings, never in our code
03

Access control

  • Your login sees only your business. Every request to the database is checked against your login, so one client can never see another client's data
  • Multi-branch businesses. An owner sees their own branches; a branch manager's brief covers only that branch
  • Our team. Access to production systems is restricted to the Foreword founders
  • Our accounts. Every account that runs the service is protected with two-factor authentication
04

Where your data is stored

Our database (Supabase) and the servers that prepare your briefs (Railway) are hosted in the United States. Our website and client portal are hosted by Netlify. Personal data is transferred outside the UAE only with appropriate safeguards, as described in our Privacy Policy.

05

AI and your data

We use Anthropic's Claude to write parts of your brief in plain language. Under Anthropic's commercial terms, your data is not used to train its models. Numbers in your brief are worked out by our own code from your files, and the AI is checked against them.

06

Who processes your data

We use a small number of established providers, each bound by its data processing terms:

  • Supabase. Database and portal login
  • Railway. Servers that run our schedule and prepare your briefs
  • Google. Read-only Drive access to your shared folder, and website fonts
  • Twilio. WhatsApp message delivery
  • Anthropic. Plain-language writing in your briefs
  • Microsoft. Our email, including portal invitation and password emails
  • Netlify. Hosting for our website and client portal

We never sell your data or share it for anyone else's use. Industry benchmarks, where offered, use only combined, anonymised figures across many businesses, never any single business.

07

Confidentiality

Every client receives a full mutual Non-Disclosure Agreement (NDA) before we access any data.

08

Retention and deletion

  • While you are subscribed, we keep your history so your portal can show it
  • After cancellation we stop reading your Drive folder and delete your data within 30 days
  • On written request, all Foreword-held data about your account is permanently deleted within 14 days
  • Your original files in your own Google Drive are always yours and are never touched
09

Report a concern

If you notice anything that looks wrong, or want our security details for your own review, contact us at info@foreword-ai.com or on WhatsApp at +971 52 557 4159. We respond to security reports as a priority.