Framvis1. About this page
Each statement below describes how Framvis is built today, and each one is checked against the code by our release tests, so a change that makes one untrue fails before it ships. We list only what the code does. This page makes no claim about certifications or external audits.
2. Passwords and two-factor sign-in
Passwords are stored only as a salted one-way hash, never in a form we can read back.
Two-factor sign-in uses time-based codes from an authenticator app. We must be able to read the secret behind your codes to check one, so that secret is encrypted with a key kept outside the database. Your recovery codes are stored only as hashes, and each one works once.
3. Cookies and forged requests
The cookie that keeps you signed in, and the “remember me” cookie if you tick it, are marked HttpOnly, so scripts on the page cannot read them, and SameSite=Lax, so the browser leaves them off requests that other websites start in the background. When the site is served over HTTPS they are also marked Secure, so the browser never sends them over an unencrypted connection.
Every request that changes something while you are signed in must show it came from Framvis itself: the app’s requests carry a separate anti-forgery token, and the cookie-choice form is refused unless it was sent from this site. So another website cannot make your browser change something in your account.
4. API tokens
An API token is shown once, when you create it. We keep only a hash of it, never the token itself.
You can limit a token to the IP addresses or address ranges it may be used from. A request from any other address is refused. If that list can ever not be read back, the token is refused everywhere rather than allowed from anywhere.
5. Integrations and the addresses you give us
The address and the signing secret or access token of each integration you connect — Slack, HubSpot or your own webhook — are encrypted with a key kept outside the database, separate from the two-factor key.
When we deliver to an address you typed in, every delivery: accepts only https on the standard port; looks the name up and refuses private, loopback and link-local addresses, including the cloud-metadata address; connects only to the address it checked; never follows a redirect; and never shows you what the receiving server answered. The address is checked again on every delivery, not only when you save it.
6. The activity record
We keep a record of who did what, and when, to your demos, workspace and account — for example publishing a demo, revoking a share link or changing a member’s role. It holds short labels and counts, never the content itself, and it is kept for 24 months, then deleted.
7. Your data, on your terms
In your account settings, Download my data gives you a machine-readable copy of the data we hold about your account, and Delete my account erases it. Both ask for your password first. The Privacy Policy describes what each one covers.
8. People who watch your demos
A demo viewer’s browser keeps a random identifier only if they accept it in our cookie banner. Until they answer, and if they reject, pages on Framvis never create, store or send it, and demos watched there send no viewing analytics at all.
9. Who processes data for us
The providers that host the Service or process data on our behalf, what each receives and where, are listed on our Sub-processors page.
10. Reporting a security problem
If you believe you have found a vulnerability, email support@framvis.com with the details and how to reproduce it. Please do not access other people’s data or disrupt the Service while testing.