Security at FACTYN

Your production data is commercially sensitive. This page describes, plainly, how FACTYN protects it today — and just as plainly, which certifications we do not hold yet. Questions or security reports: support@kapturi.com.

Tenant isolation

Every plant (tenant) is isolated at two layers: every application query is scoped to your tenant, and the PostgreSQL database enforces row-level security policies as an independent second barrier. One tenant's data is never readable from another's session or API key.

Encryption & credentials

All traffic runs over HTTPS with HSTS. Passwords are stored only as bcrypt hashes. Email addresses are verified with single-use, hashed, expiring tokens; password resets use the same scheme with a 60-minute window and never reveal whether an account exists. Optional two-factor authentication (TOTP) is available per plant. Public signup is protected against automated bot registrations.

API access

Integration API keys are shown once, stored only as hashes, revocable at any time, read-only, and rate-limited. Each key resolves to exactly one tenant.

Accountability & your data

Administrative actions are recorded in a per-tenant audit log. You can export your plant's full data (configuration, production history, audit log) from Settings at any time — your data is yours, including on the way out.

Infrastructure

FACTYN runs on Vercel (application hosting) and Supabase (managed PostgreSQL), currently in the United States. Both providers encrypt data at rest and maintain their own security certifications. Database backups are automated and managed by our database provider.

What we don't claim (yet)

FACTYN itself does not currently hold SOC 2 or ISO 27001 certification, and we do not yet publish a contractual uptime SLA — we would rather tell you that directly than imply otherwise. If your organization needs a security questionnaire answered or specific commitments for a contract, write to us and we'll respond with what is actually in place.