Security and data protection

Client, health and team data in one place demands clear rules about who sees what. These are the ones in the app today.

Permissions

85

Down to each field

85 distinct permissions grouped into editable profiles. Every record field has its own visibility per role — the front desk doesn't see what only the practitioner should.

Audit

Who opened and changed what

Document views and downloads are logged with time and origin. Changes to records, HR, roles, permissions and professional credentials are too.

Passkeys

Sign in without a password

Sign in with your own device's fingerprint or face recognition (WebAuthn).

Hosting

Database in the EU

The application database is hosted in the EU region (Ireland). The optional AI features use OpenAI and Google models through the Lovable AI Gateway and may be processed outside the EU, under GDPR transfer safeguards.

AI: external providers

Portability

Your data is yours

Export profiles define which columns leave, and every export run is recorded. No lock-in and no permission needed to leave.

Retention

Periods per category

Retention periods set per document category, per organisation.

AI · early access

AI works within your rules.

The assistant inherits the permissions of whoever uses it and leaves every proposal waiting for a person.

Copilot, HR assistant and survey analysis: OpenAI models. File import, document drafts, kiosk speech recognition and cover images: Google Gemini models. All through the Lovable AI Gateway.

  1. 01

    Human approval

    No proposal is carried out without a person's approval.

  2. 02

    Kill switch

    Switches agents off for the whole organisation at once.

  3. 03

    Proposals expire

    Anything not approved expires — 48 hours by default.

  4. 04

    Usage log

    Every question is logged with its sources — and refusals, with the reason.

At the front desk

The front-desk tablet handles client check-in and team clock-in. So it isn't an open screen.

  • Clock-in by personal PIN or a QR code that expires within seconds
  • Temporary lockout after failed attempts
  • Leaving kiosk mode is PIN-protected
  • Time-clock corrections are audited

Transparency

What this page doesn't show

We don't display certification badges we don't hold. The data processing agreement (DPA), the sub-processor list and the impact assessment are published in the app; if your organisation needs a security questionnaire, ask us — we'll answer in writing.

Questions

Where is the data stored?

The application database is hosted in the EU region (Ireland). AI features are optional and use OpenAI and Google models through the Lovable AI Gateway; they may be processed outside the EU under GDPR transfer safeguards. The full sub-processor list is in our data processing agreement (DPA): https://app.myfarol.tech/dpa

Can the Farol team see my data?

Actions taken by platform administrators are recorded in the security log, with the resource, the action and the reason.

Can I take my data with me if I leave?

Yes. Export profiles let you choose the columns, and every export is recorded. There's no lock-in.

Do you offer a data processing agreement (DPA)?

Yes. The DPA, with the sub-processor list, is published at https://app.myfarol.tech/dpa, and the impact assessment (DPIA) at app.myfarol.tech/aipd. For specific questions, use the contact form and choose “Data protection and GDPR”.

Need more detail?

DPA requests, security questionnaires and GDPR questions — a person replies.

Talk about dataStart free