Trust and security at PromptFluent
Your prompt libraries hold how your organization actually works with AI. This page says what we do to protect them today, what our hosting providers do on our behalf, and what isn't in place yet. If something you need is missing, ask us.
Last Updated: October 26, 2026
SOC 2 Status
PromptFluent has not received a SOC 2 report.
Reports held by our hosting providers cover their infrastructure, not PromptFluent.
Enterprise buyers can request our security questionnaire responses and Data Processing Agreement today; see Documentation Available Upon Request below.
What We Have in Place
| Control Area | Status | Details |
|---|---|---|
| Access Controls | Implemented | Role-based access for team workspaces; tenant isolation enforced by database row-level security and by membership checks in application code |
| Data Encryption | Implemented | AES-256 at rest (database provider); TLS 1.2 or 1.3 in transit; integration tokens additionally encrypted by the application |
| Incident Response | Defined in DPA | We investigate and contain suspected incidents and notify affected customers as our agreements and the law require. Breach notification terms are in section 9 of our DPA. |
| Vendor Management | Documented | Sub-processors bound by written data-protection terms (see our DPA) |
| Change Management | Implemented | Every change ships through a pull request that must pass automated checks before a human merges it. Pull requests are also reviewed by automated code-review tools. |
| Monitoring & Logging | Implemented | Error and security-event monitoring; audit trails for governed team actions |
Data Protection
Our production database is encrypted at rest with AES-256 by our database provider, Supabase. That database holds:
- Prompt libraries and content
- Organization and team data
- User account information
Integration credentials, such as Slack tokens, are also encrypted by PromptFluent with AES-256-GCM before they are stored.
Connections to PromptFluent use HTTPS over TLS 1.2 or 1.3. Our hosting provider redirects plain HTTP to HTTPS, and we send an HTTP Strict Transport Security (HSTS) header so browsers stay on HTTPS.
Each organization's data is logically isolated in two layers: row-level security policies in the database, and membership checks in our application code that scope team requests to that team.
Your Data, Your Control
This is a core commitment:
Your private prompt libraries, proprietary business content, uploaded materials, team workspaces, and customer-specific outputs are never used to train public AI models, shared with other customers, published, or sold as customer-identifiable data.
What that covers:
- AI model providers that power in-product features. We send content to our AI model providers to deliver the feature you asked for. Under their terms they may keep it for a limited period, for example for abuse monitoring.
- Service providers we use, which are bound by written data-protection terms
- Our recommendation and analytics systems — they never expose your private content to other customers
What it can't cover: when you copy a prompt into an AI tool you use directly, such as your own ChatGPT, Claude or Gemini account, that tool's own terms and settings decide how the conversation is used.
PromptFluent does use platform-usage and AI-execution telemetry to operate and improve the Service: recommendations, benchmarks and research into AI execution trends. This telemetry is pseudonymous, not anonymous, and we don't show your confidential content to other customers. Team benchmarks compare your team with averages across other teams. We show no individual team's figures, but with few teams on the platform an average may relate to a small group. See our Privacy Policy for what we may analyze and what we never share, and our Data Processing Agreement for enterprise terms.
Team workspaces can export their prompt library as JSON, CSV or Markdown, and the team audit log as CSV, JSON or XLSX. Prompt exports follow your team's enforcement settings. For a copy of your personal data, email privacy@promptfluent.com.
When you delete your account in Settings:
- Access ends immediately: sign-in, active sessions, team memberships, browser-extension tokens, workflow API keys and workflow webhooks are revoked
- For 90 days your account is kept, and support can restore it if you change your mind (email privacy@promptfluent.com)
- After 90 days, an automated daily job permanently deletes your account and personal data (profile, personal prompts, favorites, history, sessions, tokens and profile photo), along with any team you owned on your own
- Work you added to other teams' workspaces stays with those teams, credited to “Deleted user”. Audit, consent, sign-in and API-log records are kept with email, name, IP-address and browser fields cleared, and usage analytics keep a random internal identifier in place of your account; these records are pseudonymous, not anonymous
- Billing records held by our payment processor (Stripe) aren't deleted by this process. Copies in our database backups expire up to 8 days after permanent deletion, on our current database plan
- If you still own a team that has other active members, transfer ownership first; we won't delete a team out from under its members
Cancelling a paid plan doesn't delete anything. Enterprise deletion terms are set out in our Data Processing Agreement.
Access Control
- Sign in with email and password, or with Google or Microsoft
- Sign in with Google or Microsoft is available on every plan. SAML single sign-on isn't available in the product today — talk to us about enterprise identity requirements.
- PromptFluent doesn't currently offer its own multi-factor enrollment. If you sign in with Google or Microsoft, that account's multi-factor settings apply.
- Sessions are managed by our authentication provider, Supabase Auth
- Role-based access control (RBAC)
- Team roles: Owner, Admin, Reviewer, Contributor, Viewer
- Permissions are enforced on the server, not just hidden in the interface
- Optional separation of duties, so authors can't approve their own prompts
Infrastructure Security
PromptFluent runs on two hosting providers. The last column lists each provider's own assurance report, which covers that provider's services, not PromptFluent.
| Component | Provider | Location | Provider's Own Assurance |
|---|---|---|---|
| Application hosting and edge network | Vercel | Application functions in the US (Washington, D.C. region); static content cached on Vercel's global edge network | SOC 2 Type II report held by Vercel |
| Database and authentication | Supabase, on AWS | US East (N. Virginia), AWS us-east-1 | SOC 2 Type II report held by Supabase |
PromptFluent has not received a SOC 2 report. Reports held by our hosting providers cover their infrastructure, not PromptFluent.
- DDoS mitigation and firewall protections provided by our hosting platform, Vercel
- Rate limiting on public, AI-backed and scrape-prone endpoints
- Bot filtering on sign-in and sensitive endpoints, plus security headers including HSTS and frame protection
Incident Response
We investigate and contain suspected incidents and notify affected customers as our agreements and the law require.
- Detection:Error and security-event monitoring
- Communication:Customer notification without undue delay, and within 72 hours of becoming aware of a personal data breach, as set out in section 9 of our DPA
If you discover a potential security vulnerability:
- Email: security@promptfluent.com
- We acknowledge receipt within 24 business hours
- We investigate all reported concerns
Vendor Management
How we manage sub-processors, as set out in our Data Processing Agreement:
- Each sub-processor is bound by written data-protection terms consistent with the DPA
- Enterprise customers get notice of intended sub-processor changes and a reasonable opportunity to object
- A current, complete list is available on request from privacy@promptfluent.com
| Vendor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | US (AWS us-east-1) |
| Vercel | Application hosting and edge delivery | US functions; global edge caching |
| Stripe | Payment processing | US |
| Resend | Delivery of account, transactional and service emails | US |
| AI model providers (OpenAI, Anthropic) | Power in-product AI features. Content is sent to deliver the feature you request; under their terms providers may keep it for a limited period, for example for abuse monitoring | Provider infrastructure; details on request |
These are the key sub-processors, not every one. The full list is available on request.
Business Continuity
- Daily automated database backups, run by our database provider, Supabase
- Daily backups kept on a rolling basis on our current Supabase plan; deleted data can remain in them for up to 8 days
- Incident communication to affected customers by email
Compliance
- Data Processing Agreement available for enterprise customers
- PromptFluent has not received a SOC 2 report.
- Privacy requests (access, correction, deletion, export) handled through privacy@promptfluent.com
Whether your use of PromptFluent meets GDPR, CCPA or any other law depends on the data you put in, how you configure PromptFluent and which rules apply to you. We provide the controls and terms on this page; we don't claim compliance on your behalf.
- Additional compliance frameworks evaluated based on customer needs
For enterprise customers and prospects, we can provide:
- Security questionnaire responses
- Data Processing Agreement (DPA)
- Penetration test summary (when available)
Contact: sales@promptfluent.com
Frequently Asked Questions
Does PromptFluent have a SOC 2 report?
Not yet. PromptFluent has not received a SOC 2 report. Reports held by our hosting providers cover their infrastructure, not PromptFluent.
Where is my data stored?
In a Supabase-hosted PostgreSQL database in the United States (AWS us-east-1). There's no option to choose a different region today.
Do you use my prompts to train AI models?
No. We don't use your private prompt libraries, business content, uploads, team workspaces or outputs to train public AI models. We send content to our AI model providers to deliver the feature you asked for. Under their terms they may keep it for a limited period, for example for abuse monitoring. We do use usage telemetry, which is pseudonymous, not anonymous, to improve PromptFluent itself, as our Privacy Policy explains. If you copy a prompt into an AI tool you use directly, such as your own ChatGPT or Claude account, that tool's terms and settings apply.
Can I get a copy of my data?
Yes. Team workspaces can export their prompt library (JSON, CSV or Markdown) and the team audit log (CSV, JSON or XLSX) from the app. For a copy of your personal data, or anything an export doesn't cover, email privacy@promptfluent.com.
What happens to my data if I cancel?
Cancelling a paid plan doesn't delete your account or your data; the account moves to the Free plan. When a Team subscription ends, the Team workspace and its export tools stop being available, so export what you need first, or email privacy@promptfluent.com for a copy. Deleting your account is a separate step, described under Data Deletion above.
Do you support SSO?
Sign in with Google or Microsoft is available on every plan. SAML single sign-on isn't available in the product today — talk to us about enterprise identity requirements.
Do you support multi-factor authentication?
PromptFluent doesn't currently offer its own multi-factor enrollment. If you sign in with Google or Microsoft, that account's multi-factor settings apply.
How do you handle security incidents?
We investigate and contain suspected incidents and notify affected customers as our agreements and the law require. If a personal data breach affects your data, we notify you without undue delay and within 72 hours of becoming aware of it, as set out in section 9 of our Data Processing Agreement.
This page was last revised on October 26, 2026. It describes our current practices; it is not an audit report. We update it when those practices change.