How we protect the people and items in FindBack

Security controls

• Encryption in transit: TLS 1.2 or later for every connection, with HSTS; connections from our servers to the database use verified TLS.
• Encryption at rest: the database and file storage are encrypted at rest by our hosting providers. Serial numbers, ID numbers, owners’ private notes, claim evidence and answers to ownership questions are additionally encrypted field by field with AES-256-GCM.
• Passwords are stored only as argon2id hashes, need at least 12 characters, and are checked against a list of common and breached passwords. People can also sign in with Apple or Google.
• Two-step sign-in with an authenticator app is required for institution staff and FindBack moderators. Institutions on Pro and Enterprise can use their own single sign-on (OIDC or SAML) and SCIM.
• Images are uploaded to a quarantine area, re-encoded, and stripped of all EXIF and GPS data before anyone else can see them.
• Access is need-to-know: claim evidence is visible only to the person deciding that claim; institution staff see only their own organization’s items.
• Audit trail: staff and moderator actions are written to an append-only, tamper-evident audit log.
• Abuse protection: a web application firewall, rate limits, message limits, blocking and reporting, and warnings on messages that look like a known scam.

Privacy commitments

• We don’t sell personal data and we don’t show ads.
• The app and this website use no advertising or analytics trackers.
• Public maps show an approximate area (at least 250 metres), never an exact location, and your live location is never stored.
• Lost medical items are hidden from public view by default.
• You can get a copy of your data or delete your account at any time. See the Privacy Policy.

Where data is stored

FindBack runs on Cloudflare, with the database on PlanetScale, in the United States. Each data region is a separate deployment: nothing is copied between regions. A European Union data region is being prepared for institutions that need data to stay in the EU.

Sub-processors

These companies process personal data on our behalf. Each is bound by contract terms that require it to protect that data, consistent with this page and our Privacy Policy.

Institutions can also connect their own identity provider for staff sign-in. We give institutional customers notice before adding a new sub-processor, as set out in their agreement.

Accessibility

We design the app, the institution portal and this website to meet the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. Every build of the portal is checked with automated accessibility tests; a full Accessibility Conformance Report, including testing with assistive technology, is in preparation. If something isn’t accessible to you, tell us at support@findbackai.com and we’ll help you directly and fix it.

Certifications and documents

FindBack AI does not yet hold a SOC 2 report or other security certification. Institutions can ask us for:

• our standard institutional agreement and data processing addendum,
• answers to your security or privacy questionnaire, and
• the current sub-processor list and change notices.

Email info@findbackai.com.

Reporting a security issue

If you believe you’ve found a security vulnerability in FindBack, email security@findbackai.com with the details and how to reproduce it. Please don’t access other people’s data, degrade the service or disclose the issue publicly before we’ve had a reasonable time to fix it. We’ll acknowledge your report within 3 business days and keep you informed. We don’t currently offer a bug bounty. Our security.txt has the same contact details.