For IT, security and procurement reviews
Security and data handling
Engineering data about safety functions is sensitive. This page states where it goes, who can see it and how to remove it, in the order a supplier security questionnaire asks.
Data flow
By default a project lives only in the engineer's browser. Data reaches a server only for a calculation, a saved project or an AI question, and each path is shown here.
Answers for a security review
Short answers to the questions most supplier assessments ask. Ask for anything else; we answer questionnaires in writing.
| Hosting | Cloudflare Workers and Cloudflare D1. Cloudflare holds a SOC 2 Type II report (Security, Confidentiality, Availability). |
|---|---|
| Encryption | HTTPS only, minimum TLS 1.2, for the site and the API. D1 encrypts all stored data at rest with AES-256, keys managed by Cloudflare. |
| What is stored | Accounts, licences and projects that a paid user chooses to save. Calculation inputs are processed in memory and not stored. Free calculators send nothing. |
| Separation | Saved projects are keyed to one licence; members of a team licence see only that licence's projects. |
| Credentials | Passwords stored only as salted PBKDF2 hashes; licence keys and one-time links stored only as SHA-256 hashes. Sessions expire and can be ended by signing out. |
| AI assistant | Optional. A question and the function it concerns go to Anthropic only when the user asks one. Under Anthropic's commercial terms the content is not used to train models. Calculations never depend on the AI. |
| Payments | Paddle, merchant of record, handles card data, invoices and sales tax. Paddle holds a SOC 2 Type 2 report. First Out receives only the buyer email, plan and order references. |
| Tracking | No analytics, advertising or tracking cookies. Usage counts are kept without personal data. |
| Retention and deletion | Saved projects can be exported or deleted by the user at any time and are deleted automatically 180 days after the licence ends. Account deletion on request. Details in the privacy notice. |
| Location | Cloudflare's global network; providers may process data outside Türkiye and the EEA, under standard contractual clauses. |
| Restricted networks | An on-premises version for plants without internet access or with data residency rules is planned for Enterprise: the same engine on your server, with the AI assistant off or pointed at a provider you approve. Tell us what your plant needs. |
| Certifications of First Out | First Out is a small supplier and holds no SOC 2 or ISO 27001 certification of its own. It relies on the certified providers above and answers your questionnaire directly. |
| Incidents | A personal data breach affecting your account is notified to you without undue delay and to the authorities as GDPR and KVKK require. |
| Contract documents | Terms of service, licence, privacy notice and refund policy are public. A data processing agreement for Team and Enterprise is available on request. |
Buying through your company
Procurement in short
- Card, online: Pro and Project Pass through Paddle, with a VAT invoice issued by Paddle as merchant of record.
- Purchase order and invoice: Team and Enterprise, and Project Pass for several engineers; send the PO details and the licence is issued on order.
- Evaluation: the free plan needs no account; a time-limited trial key for a review team is available on request.
- Supplier documents: this page, the validation report, the methods and the terms cover most supplier registration forms.