01
Workspace access
Authenticated, role-aware access keeps formula versions, costs, documents, and batch evidence inside the right customer workspace.
Security at Formuley
Your formulas stay yours.
Formuley protects formula IP across the product record—from supplier evidence and AI review to batches, exports, and account access.
Formula IP boundary
Access follows the workflowPeopleRole-aware access
SuppliersShared artifacts only
Formuley AIFiltered context
ExportsCustomer controlled
Protected product record
Formula product recordVersion 03 · suppliers · cost · evidence · batchesTenant-privateRecords
EncryptedIn transit + at rest
Metadata-onlyAI logs by default
Encrypted
In transit + at rest
Tenant-private
Customer records
Metadata-only
AI logs by default
United States
Primary hosting region
Formula IP Protection
One product record. Deliberate boundaries.
The formula stays connected to the work around it without making every person, supplier, or AI workflow an all-access pass.
02
Supplier sharing
Supplier workflows expose only the artifact you choose—not private percentages, costs, margins, customer lists, lab notes, or launch timing by default.
03
AI context
Restricted formula, supplier, batch, document, and cost context is minimized or blocked before an external AI request unless the workflow explicitly needs submitted content.
Controls
Every layer has one job.
Security is easier to evaluate when workspace controls, infrastructure, and governance are separated by responsibility.
01 / Workspace
Who can enter—and what they can reach.
Tenant-private records
Authenticated requests, customer-private records, and internal access limits help prevent cross-customer exposure.
Identity and sessions
Role-based permissions, secure sessions, login notifications, and device sign-out controls protect account access.
Enterprise administration
Enterprise can scope identity rollout, trusted network access, custom roles, TOTP-based 2FA, and session management.
02 / Infrastructure
How records are stored and recovered.
Encryption
Product and account data are encrypted at rest and in transit. Supported backups use encrypted storage.
Managed hosting
Primary production hosting is in the United States today. EU-region hosting is planned for organizations that require it.
Backups and recovery
Eligible paid plans use automatic encrypted backups. Retention varies by plan, and restoration is not guaranteed after account deletion.
03 / Governance
What security and procurement can review.
Audit posture
Logged access and Enterprise audit-retention options support investigations, internal review, and buyer diligence.
Customer data rights
Export, correction, deletion, DPA, and verified manual privacy request workflows are available where applicable.
Vendor evidence
Managed hosting and data vendors provide security evidence that can support procurement review.
AI boundary
AI sees the task. Not the whole vault.
Formuley minimizes model context, keeps human review visible, and gives enterprise teams a path to stricter AI policy.
Context filter
Policy before model request
Allowed
The minimum context a workflow needs
Product category, task intent, and customer-submitted content needed for the requested AI feature.
Blocked by default
Restricted formula and commercial detail
Exact percentages, supplier-specific records, cost breakdowns, margins, and private launch context.
Customer choice
Stricter enterprise AI controls
Private-lane controls, no-external-AI policies, or AI-disabled workflows can be scoped by agreement.
No generalized-model training. Formuley does not train generalized AI or machine-learning models on customer formulas unless there is a separate explicit opt-in agreement.
Metadata-only by default. Long-lived AI audit records keep operational metadata rather than prompt or response content unless a different workspace retention mode is explicitly enabled.
Deployment
Infrastructure follows the requirement.
Most teams begin with product controls. Enterprise infrastructure is scoped only when the security requirement calls for it.
01
Available now
Formula IP Protection
Supplier-safe boundaries, metadata-only AI logging by default, DPA review, customer exports, deletion workflows, and audit posture.
02
Enterprise agreement
Formuley-managed private deployment
Dedicated tenant or private-cloud scope, private AI or AI disabled, custom security review, and annual agreement support.
03
Scoped beta
Customer-managed private cloud/on-prem
For large enterprise requirements with paid implementation, a named customer IT owner, and shared operations responsibilities.
Your data rights
Your records remain portable.
- Export account, workspace, AI, and marketing data from settings.
- Correct account information and withdraw separate marketing consent.
- Delete active-system data, subject to required retention and encrypted backup rotation.
- Request security or fraud-prevention records through a verified manual privacy request.
Read the export and deletion limits
Self-serve exports do not include security or fraud-prevention logs; those require a verified manual privacy request. Account deletion removes active-system data subject to legal retention and normal encrypted backup rotation.
What we do not do
Subscriptions fund Formuley. Your data does not.
Sell your data.
Share formulas with other customers.
Let suppliers see percentages, costs, margins, private customer lists, lab notes, or launch timing by default.
Accept protected health information without a signed Business Associate Agreement and approved controls.
Read every data-use commitment
- Train AI or machine learning models on your formulas unless there is a separate explicit opt-in agreement.
- Send exact formula percentages, supplier details, or cost breakdowns to external AI by default.
- Use customer content to build advertising profiles.
- Use customer formulas to create Formuley-owned products.
- Share formulas, supplier records, or customer data with competitors.
Current posture
What is true today.
Clear qualifiers matter more than borrowed trust badges. These are the boundaries procurement should evaluate now.
SOC 2
Formuley is not currently claiming its own SOC 2 certification.
Region
Primary production hosting is in the United States. EU-region hosting is planned.
Health data
Do not upload protected health information unless Formuley has signed a Business Associate Agreement and approved the required controls in writing.
Recovery
Backup retention varies by eligible paid plan; restoration is not guaranteed after deletion.
Security reviews and procurement
Get the evidence your review needs.
Request available DPA and SCC paperwork, a security questionnaire response, subprocessor detail, uptime documentation, US-hosting posture, or deployment review.
Responsible Disclosure
If you believe you found a vulnerability, email security@formuley.io. We acknowledge good-faith reports within 48 hours and work toward resolution.