Security, privacy and reliability

All connections to naffe use HTTPS.

Data stored in our databases is encrypted at rest using AES-256.

When naffe connects to other tools on your behalf, those credentials receive an additional layer of protection using AES-256-GCM encryption, with the encryption key held separately.

Apps and data belonging to different businesses are kept apart by the naffe platform, and requests from published apps are limited per app.

Staff access is currently limited to the owner.

naffe databases are hosted in the European Union.

Our database infrastructure is located in Stockholm and Ireland, and naffe's servers run in Paris.

Published apps are delivered through a global network for performance, while their data remains in Ireland.

naffe uses Anthropic's Claude as its AI provider.

Under Anthropic's API terms, customer data sent through the API is not used to train Anthropic's models.

We state this as Anthropic's policy, not as a separate guarantee made by naffe.

Payments are handled by Stripe.

naffe does not see or store your card number.

Every published version of an app is kept and can be rolled back.

Changes made with Wingman can also be undone.

Our database provider takes daily backups.

We do not advertise a promised uptime percentage.

We measure it.

naffe checks the following every 5 minutes:

• the naffe.ai website
• the naffe service
• a live published app

The figure shown below reflects actual measured uptime over the previous 30 days.

Missed checks count as downtime.

naffe uses Sentry in Germany to monitor technical errors.

Names, email addresses and phone numbers are scrubbed from error data before it is sent.

naffe relies on specialist providers for parts of the service:

• Vercel - Hosting
• Supabase - Databases
• Anthropic - AI
• Stripe - Payments
• Resend - Email
• Sentry - Error monitoring in the EU
• Upstash - Rate limiting
• Google Analytics - Website analytics, only after cookie consent
• Unsplash - Images
• ScreenshotOne - Screenshots

We update this list when the services naffe relies on change.

naffe uses Google Analytics for website analytics.

Google Analytics cookies, including _ga, are only set after you give consent.

Files uploaded to naffe can currently be accessed by anyone who has the file link.

You should not treat an uploaded file as private simply because the link has not been shared publicly.

We are stating that clearly because we do not want to imply a level of file privacy that does not exist today.

naffe keeps published versions, supports rollback, allows Wingman changes to be undone, and uses daily database backups.

If naffe becomes aware of a personal data breach that requires notification, our security and data-processing documentation uses a 72-hour notification period.

naffe does not currently claim:

• SOC 2 certification
• independent penetration testing
• a guaranteed uptime level
• zero data retention by Anthropic
• automatic data portability

We would rather be precise about what exists today than make promises we cannot prove.

You should not need to read a technical manual to understand how naffe protects your business.

Our approach is simple:

Protect what matters. Measure what runs. Say only what is true.