Current security posture, stated plainly.

An Atlas dataset you save, with its title, question, filters and revision history, is visible only to the account that saved it. The database enforces this with row-level security, not only the app.

Atlas has no team sharing. Another person sees one of your datasets only through a share link you create. Workspace data is visible to members of the organization that owns it, according to their role.

PhaseFolio administers the databases that run the service and can technically reach the records in them. Customer-managed encryption keys are not offered. If a deal is confidential, a dataset can describe the indication or target without naming it.

Atlas chat helps you set up or change a dataset. When you use it, Atlas sends Anthropic your request, the dataset’s current definition, the list of values Atlas can filter on and, while you set up a dataset, the last few messages of that conversation. It never sends study records, counts or results.

Atlas keeps a fingerprint of each chat request, not its text, along with any changes the chat proposed to a saved dataset. Building, filtering and exporting a dataset run no AI model.

Under Anthropic’s commercial terms, Anthropic may not train models on the content we send. Anthropic deletes API inputs and outputs within 30 days, unless content is flagged for a usage-policy review, which can keep it for up to two years, or the law requires longer.

In Workspace, content you select is sent to the Anthropic API only when you start an AI-assisted extraction, synthesis or analysis.

Production data is stored in the eastern United States.

• Accounts, saved Atlas datasets, chat records and Workspace data are in Supabase PostgreSQL, in the AWS us-east-1 region.
• The public registry data Atlas searches is in a separate Neon PostgreSQL database, also in AWS us-east-1. It holds public records only.
• The API runs on Google Cloud Run in the us-east4 region (northern Virginia), separately from every database.
• Vercel serves the web pages from its global network. Clerk holds sign-in details.
• Copies of the public source documents we collect are kept in AWS and Microsoft Azure storage.
• Payments go through Stripe’s hosted pages. PhaseFolio does not store card or bank details.
• Transport uses HTTPS/TLS, and the sites require it on return visits. Production secrets are kept in each platform’s environment store, and the API’s in Google Secret Manager.
• Test environments use their own account databases, sign-in and keys.

Saved datasets and their history are kept while your account is open. Atlas has no delete control yet. To delete a dataset or your account, email contact@phasefolio.com.

When an account is deleted, nobody can sign in to it and its share links stop working at once. Its datasets, their history and its chat records become due for permanent removal 30 days after deletion, unless a legal hold applies. We run that removal ourselves; it is not yet automatic.

Product events, described below, have no set retention period yet. Vercel Web Analytics keeps page-view records available to us for 12 months on our current plan and may keep them longer. What Anthropic keeps is described under AI requests.

A share link opens a read-only copy of one saved version of a dataset: its title, question, filters and the studies that match, read from the same dated data release. Studies you excluded are left out and only counted. Later changes to the dataset do not appear through the link.

The page does not show your name or email. Anyone with the link can open it without signing in, and search engines are asked not to index it. A signed-in viewer can copy the dataset into their own account.

Only datasets in a personal account can be shared. Each dataset can have up to ten active links, and you can revoke any of them; a revoked link stops working at once. Links do not expire on their own, and they stop when the dataset is deleted or the account is closed.

PhaseFolio’s sites run no advertising scripts. We count page views on the public website and on Atlas’s shared-dataset and example pages with Vercel Web Analytics, from our hosting provider. It sets no cookies, and before a view is sent we replace a shared dataset’s link code with a placeholder and keep only campaign tags in the address. Atlas pages behind sign-in, such as datasets, chat and billing, are not counted.

Atlas records a fixed list of product events in our own database, such as a dataset built, an export downloaded or a plan limit reached. An event holds your account reference, the time and at most a size range, a file format or a yes-or-no flag, plus whether you signed up with a company or a personal email domain, without the domain itself. Events never hold your questions, chat text, filters, study lists or email address.

The sites set no analytics or advertising cookies, only those that sign-in and a pending copy or export need. A campaign tag on a PhaseFolio link is recorded, with the time, when the link opens a shared dataset, and with the new account if you sign up; nothing is stored on your device for it.

Feedback and missing-study reports you send from Atlas reach us by email through Resend, with your account reference and the filters you were using.

Atlas works with public records: clinical trial registrations from public registries. Workspace adds the asset-level metadata a user enters: indication, modality, clinical stage, costs, deal terms, source citations and scenario assumptions.

PhaseFolio is not a patient-data system. Do not enter Protected Health Information, patient-level records, medical charts, genetic test results tied to an individual, or other regulated clinical data.

• Authentication is handled through Clerk-managed identity infrastructure.
• An Atlas dataset belongs to the account that saved it.
• Workspace access is organization-scoped, with role-based permissions in the app layer.
• Workspace write access is restricted by organization role; viewer roles fail closed.
• Database row-level security is enforced for product app traffic through a non-bypass PostgreSQL runtime role.
• Workspace policies are keyed to the active organization inside request-scoped database transactions.
• Public pages, including sources, methodology and export verification, do not require an account.

Atlas keeps every saved version of a dataset, pinned to the dated data release it was built from, so an earlier result can be reopened as it was. An Atlas export, in CSV or Excel, pairs each value with its registry source, states the data-as-of date and carries each registry’s attribution terms. Atlas exports are not signed.

Workspace records material product actions as audit events and preserves issued signed-export records so reports can remain verifiable after publication. Each Workspace signed export carries a content hash plus model, methodology, and benchmark version metadata. The public verification endpoint confirms authenticity and version provenance without exposing the report contents.

PhaseFolio does not currently claim SOC 2 Type I, SOC 2 Type II, ISO 27001, HIPAA, or a formal GDPR compliance attestation. SOC 2 Type I readiness is the first external-attestation target after operating-control evidence is assembled and reviewed.

SOC 2 Type II would follow after an operating evidence window. ISO 27001 and HIPAA readiness will be evaluated as customer and data scope require. Until then, the public security posture is deliberately explicit: what is implemented, what data is in scope, what is out of scope, and which artifacts are independently verifiable.

A data processing agreement, including the EU Standard Contractual Clauses and the UK Addendum, and a written security and data summary are available on request. There is no completed industry security questionnaire yet. For any of these, contact us.

• Clerk for sign-in and account identity.
• Vercel for web hosting and page analytics.
• Supabase for the production account and product database.
• Neon for the public registry database.
• Google Cloud for the backend API and its secrets.
• Anthropic for Atlas chat, Workspace AI-assisted features, and preparing our business outreach emails.
• Stripe for payments and invoices.
• Resend for product email, including feedback reports.
• Tally for the support and Workspace request forms.
• Cal.com for booking calls.
• Google Workspace for company email.
• Clay for finding and checking the work email addresses of people we email about PhaseFolio.
• Amazon Web Services for storing and processing public source documents, and Microsoft Azure for an archive of them.
• Other AI providers process public source documents in our data pipelines; they receive no customer content.

Report suspected vulnerabilities, authorization issues, or data-handling concerns to contact@phasefolio.com. Please avoid public disclosure until PhaseFolio has had a reasonable opportunity to investigate and remediate.