Security
Fred handles your commercial strategy. Here is how it is kept.
FRED IQ is in private beta. Everything below is either enforced in code today or listed as not yet done. Nothing here is aspirational.
Your workspace is isolated in the database, not just the app
Every record carries the organization it belongs to, and PostgreSQL enforces that with forced row-level security. Customer requests run under a restricted database role. A bug in a screen cannot show you another company's work, because the database refuses to return it.
What is shared across customers, stated plainly
One thing is: an objective verified contact fact — a person, their employer, their verified work address, and when we verified it — so the platform stops paying to re-verify people it already knows. Your targeting, your notes, your feedback, and which companies you pursue are never part of it.
Credentials never come back out
Provider keys are encrypted at rest, held server-side only, redacted from logs, never placed in a prompt, and shown to you afterwards only as their last four characters. There is no screen that reveals a stored key.
Web pages are read as evidence, never as instructions
Anything Fred retrieves is quarantined and treated as hostile data: facts are extracted, validated and reasoned over as structured claims. A sentence on a web page has no authority to change what Fred does.
Nothing sends itself
Fred researches, recommends and drafts. A person initiates every outbound message. There is no autonomous campaign, and no path in the product that creates one.
Unknown stays unknown
Every claim is labelled known, inferred or unknown, and a claim with no source is never presented as established fact. Missing evidence holds a Find rather than becoming a plausible guess.
Operator access is reason-tagged and recorded
Platform administration is a separate, least-privileged context. Support access to a workspace is explicit, carries a stated reason, and is written to an audit record you can be shown.
What we do not have yet
The honest list.
- No SOC 2 report. We have not begun an audit, and we will not imply otherwise.
- No third-party penetration test yet.
- One deployment region. Daily database backups with a restore check, and no contractual recovery-time commitment.
- Data-processing terms are negotiated per customer rather than published.
If your review needs something that is not here, ask before you commit: hello@frediq.xyz. The Privacy Policy and Terms carry the binding commitments.