Diligence, in one page.

Ferrier Industries LLC, a US limited liability company. PaloWorks is built, sold, and supported under that name only. There is no support tier and no account-management layer — security questionnaires are answered by the people who write the product.

Email and password, a one-time link by email, a passkey (Face ID, Touch ID, Windows Hello or a security key), or Google where it is configured. Two-step verification with an authenticator app is available to every account, with single-use backup codes you can review and replace, and a workspace owner can require it for everyone in the workspace. Passwords are hashed with scrypt under a per-user salt, so we cannot read them. Sessions are database rows rather than self-contained tokens, which means signing out or resetting a password ends access immediately instead of waiting for a token to expire. Sign-in, signup, and password-reset requests are rate limited per client against a shared Postgres counter, so the limit holds across serverless instances.

The limit of this: There is no SAML or OIDC single sign-on and no SCIM provisioning.

One database, with every query that touches customer data filtered by workspace id. An id arriving in a form is re-resolved through its verified parent before anything is written, so posting someone else's invoice id does not reach someone else's invoice. Where a write could span tenants, the tenant filter is part of the same statement as the write rather than a separate check beforehand.

The limit of this: This is enforced by code convention, review, and tests — not by database row-level security. It is a real control and a real discipline, but it is not a wall. Cross-tenant defects have been found by adversarial review before release and fixed.

It never reaches us. Card entry happens in Stripe's own hosted interface. Client invoice payments are direct charges on your connected Stripe account, less a plan-based PaloWorks fee, so the money settles into your account and never sits in a PaloWorks balance. What our database stores is a Stripe customer id, a subscription id, and a connected account id — references, not instruments. There is no schema field that could hold a card number.

The limit of this: Stripe is a PCI DSS Level 1 service provider. Because cardholder data never reaches our systems, PaloWorks is outside PCI scope rather than certified within it. Those are different claims and we make only the first.

Invoices, scopes, intake forms, and contracts are shared by URL so your client never needs an account. Each token is 20 bytes from the operating system's cryptographic random source — 160 bits, not guessable at any request rate. Those pages are served noindex, nofollow, noarchive, so a link forwarded into a crawlable inbox or wiki stays out of search results. You can rotate a link, which breaks the old URL, or revoke it outright, and both are written to your workspace audit log.

The limit of this: A share link is a bearer credential: anyone holding the URL can open the document, with no password. That is deliberate, and it means a forwarded link is a shared document until you revoke it. Client statement links are the one exception to the token scheme — they are addressed by an HMAC signature over the client id, so they cannot be revoked individually.

Yes to both, without asking us. A workspace owner can export the entire workspace as one JSON file — clients, projects, intake responses, scopes, contracts, time entries, invoices, and line items — plus CSV exports for invoices, clients, time, and reports. Deleting a workspace cascades through every related record immediately and irreversibly. What survives is a single tombstone row recording that the deletion happened, the user id of who confirmed it and, for a direct workspace deletion, the counts involved; it holds no names, email addresses, contract text, or financial detail, and we remove it on request.

The limit of this: A deleted project waits in Settings → Recently deleted for 30 days before it is purged (a project deleted before the signed-records confirmation existed and holding signed records waits until an owner restores it or deletes it forever), but deleting a whole workspace is permanent, so export first. Deleting your PaloWorks workspace does not delete anything held by Stripe — close that account through Stripe.

The subprocessors listed below, and no one else. When we add or replace one, the list and its date change, and if the change is material we tell you by email or in the product. The DPA gives you a right to object.

Email security@paloworks.com. A person who works on the code reads every report and tells you how serious it is and what we intend to do about it. We will not pursue good-faith research that stays inside the published scope, and we will credit you when the fix ships if you want the credit.

The limit of this: We do not pay bounties. We read every report and fix what is real, but there is no money attached.