Security and control of your data
Fold reads your company’s data to answer with it. This is what it does to protect that data, who can see it and what we cannot yet promise you.
The same protection on every plan
Your data is protected the same way on the free plan as on the highest one. Only one thing on this page changes with the plan: company single sign-on.
- Read-only
- Fold does not write, move or delete anything in your files or your programs. It reads, and keeps a copy of what it has read in order to answer.
- Each company, separate
- Everything Fold looks up in its database is filtered by company, and an automatic test checks that no query is left without that filter. No other account sees your files or your answers.
- You choose what it sees
- Fold only knows the files you upload and the connections you authorise. A new table is not used until you confirm what each column is. You remove a file or a connection whenever you like.
- Over the internet and https only
- When Fold connects to a program of yours, it does so through public https addresses. It does not enter your internal network.
Who gets in and what they see
Signing in has to be secure without being a punishment. And once inside, not everyone touches the data.
- Passwords
They are not stored. What is stored is a digest calculated with scrypt and a different salt for each one, which does not allow the password to be recovered.
Available
- Email link, passkey and two steps
You can sign in with a link that arrives in your email, single-use and expiring after 20 minutes, or with a passkey on your phone or computer. Two-step verification is switched on in the account; the owner is offered it at the start.
Available
- Sessions
The session travels in a cookie that the page’s code cannot read and that is not sent to other sites. Only its fingerprint is stored in the database, not the session itself.
Available
- Who touches the data
Only the owner and the administrators see the list of files, the connections and the status of each source, and only they change them. The rest of the team asks questions.
To put it plainly: the permission goes by function, not by file. Any person on the team can ask about any confirmed table of the company. If there is data that part of the team should not look up, today it is not uploaded to that account.
Available
- Activity log
The owner and the administrators see what has been done in the account.
Available
- Company sign-in
Your team signs in with the company’s Microsoft Entra ID or Google Workspace account, through OpenID Connect. Tested with a simulated directory; not yet used with a company’s real directory. SAML is not available.
Available
- Signing in with Google or Microsoft
The “Continue with Google” and “Continue with Microsoft” buttons.
Coming soon
The AI does not supply the figures
What worries people most about putting an AI in a company is that it will make up a number. Fold is built so that it cannot.
- A program does the sum
- The AI understands the question; the figure is calculated by a program from your rows. Afterwards, a check discards any number in the answer that is not in your data.
- Every figure, with its source
- File, sheet and row, and the date of the last read. If the source is old or failed, the answer warns you.
- What leaves Fold
- Direct lookups are resolved without AI. Questions that need it are sent to an AI provider to be answered. Who processes your data on our behalf is listed in the privacy policy.
- Documents, with a person
- When reading invoices and delivery notes, nothing is approved on its own: each document is approved by a person.
The keys to your programs
To read from your management program, Fold needs a key from it. This is how it is stored.
- Encrypted, with one key per company
- The keys and permissions of your connections are stored encrypted with AES-256-GCM, with a key derived for each company.
- With the minimum permission
- Fold only reads. If your program allows it, give it a key that only lets it read: that is all it needs.
You leave with what is yours
Nobody stays with Fold because they cannot get their data out.
- Export
- From the app you download a file with everything from your company: your tables and your documents.
- Close your account
- You ask for it yourself from the app. You have 30 days to change your mind; after that it is deleted. Only invoices are kept, because the law requires it.
- Delete your data from this website
- What this website stores, such as your email on the notification list, is deleted when you ask: how to ask.
What we cannot yet state
We would rather say it here than have you find out later.
- Certifications
Fold does not today have ISO 27001, SOC 2 or any other security certification. If your company requires one, we are not yet your supplier.
- Backups outside the server
Encrypted backups outside the server are built and tested, but they are not counted as active until they are running in production.
Coming soon
- Where the servers are
We do not publish the location of the data centre until we have it confirmed in writing. The hosting provider is listed in the privacy policy.
- Permissions by file or by table
They do not exist. The permission goes by function, as explained above.
- SAML and user provisioning from your directory
It is where the highest plan is heading. It has no date.
Planned
- External audits
Fold’s security tests are our own and automatic. A third party has not yet audited it.
Security questions
Can Fold change or delete anything in my files?
No. Fold reads. It does not write to your Excel files or your programs, and it does not move or delete them.
Can another company see my data?
No. Each company is separate from the others in the database, and an automatic test checks that separation.
Can an employee see data that is not meant for them?
A team member does not see the list of files or the connections, but can ask about any confirmed table of the company. Today there are no permissions by file: if a piece of data should not be looked up by the whole team, do not upload it to that account.
Is my data used to train an AI?
Fold does not use your company’s data for anything other than providing you the service. The terms of the providers that process it on our behalf are in the privacy policy.
What happens to my data if I close my account?
You can export it beforehand. After you ask to close the account there are 30 days to change your mind and then it is deleted; only invoices are kept, because the law requires it.
Sign-up opens very soon
The day it opens you will register yourself, free and with no card, and a sample company from your sector will be waiting inside so you can ask your first question without uploading anything. Leave your email and we will let you know that day, once.
You're on the list.
The day sign-up opens in the app you will get one email, just one. In the meantime, have a look at everything Fold can do.
Is yours a large automation, one that connects to other systems or touches money or your customers’ data? Book a free 30-minute call.