Security

This page explains how Faylee handles the recordings and data your team trusts it with. For security questions, a vulnerability report, our data processing agreement or anything else you need for a review, write to security@faylee.app.

How recordings are handled

• Captured in the browser. A recording is made in the browser of the person reporting the bug. Nothing leaves the browser until they click Share, or Send on a recording link or the site widget.
• Secrets hidden before upload. Faylee hides passwords, tokens, cookies, authorization headers, card numbers and other values it can recognize, in the browser, before anything is uploaded. Password and payment fields on the page are masked, and so is anything a website marks with the data-faylee-mask attribute. Workspaces can add their own headers and fields to hide. Automatic redaction cannot recognize every piece of personal data, so see what it covers and record only what you need.
• Encrypted. Data is encrypted in transit with TLS and at rest by our storage providers.
• Private by default. A new recording can be opened only by people signed in to its workspace. Opening it to anyone with the link is a choice, with an optional password and expiry.
• Kept as long as you choose. On Free, recordings are hidden 14 days after they are made and permanently deleted 7 days later. Upgrading within those 7 days restores them. On Team and Enterprise, admins choose to keep recordings until someone deletes them, or to delete them automatically after 30, 90, 180 or 365 days.
• Deleted for good. A recording moved to the trash stays there for 30 days, then is deleted with its video and everything captured with it. When an account or workspace is deleted, we remove its data within 30 days, except records the law requires us to keep, such as invoices. Backups are overwritten on a rolling basis.

Access to your workspace

Access inside a workspace follows members' roles. Each person can turn on two-factor sign-in. On Team and Enterprise, workspaces can also use SAML single sign-on and SCIM, keep an audit log of important changes, and store recordings in their own S3-compatible bucket.

Infrastructure

We use trusted providers for hosting, the database, recording storage, email, payments and AI processing. Faylee's servers are in the United States. Each provider processes data only to provide its service to us, under a data processing agreement. They are listed on our subprocessors page, and you can ask security@faylee.app for more detail about any of them.

AI

The assistant's summaries and answers, and transcripts of narration, are made by AI providers. The assistant is off until a workspace admin turns it on. We do not use recording data to train AI models, and the AI providers we use do not train on it under our agreements with them. The secrets Faylee hides before upload never reach them.

Data processing agreement

For recordings, your workspace is the controller and we are its processor, as our privacy policy describes. If your company needs a data processing agreement (DPA) with us, write to security@faylee.app and we will send it.

Reporting a vulnerability

If you think you have found a security problem in Faylee, please write to security@faylee.app with what you found and the steps to reproduce it. We will reply within a few business days and keep you informed while we fix it. Please give us a reasonable time to fix it before you tell anyone else, and do not access other people's data or disrupt the service while you test.

Company details

Faylee is made by Firefight Labs, a brand of UpTech doo Beograd-Čukarica, Nedeljka Čabrinovića 33, 11030 Belgrade, Serbia. Company registration number (matični broj) 21629499, tax ID (PIB) 112220768.

Security: security@faylee.app. Everything else: hello@faylee.app.