Security at PerfIQ

Signing in

PerfIQ uses WorkOS to handle sign-in, so PerfIQ never stores a password of yours. New accounts need a work email address; personal and disposable email addresses are turned away. Your session is held in a protected cookie that page scripts cannot read, and it expires after 12 hours. When you sign out, PerfIQ also asks its sign-in provider to end your sign-in sessions, not just the one in your browser.

Your company's data stays separate

Everything you enter or that PerfIQ produces for you is stored under your account and your company workspace. When you ask for something, the system looks it up by your signed-in account, so it returns your records and no one else's. Reports are the one deliberate exception, and only when you choose to share one.

Where your data lives

PerfIQ runs on Cloudflare. Your records are kept in Cloudflare's database and storage services, and uploaded files go into a private storage bucket that can only be reached through PerfIQ itself, never by a public web address. Connections to PerfIQ are encrypted in transit, and your sign-in cookie is marked to travel only over those encrypted connections. PerfIQ relies on the protections Cloudflare provides for stored data.

PerfIQ's availability is monitored, and an alert goes out when something is wrong.

How PerfIQ uses AI

To answer you, PerfIQ sends the relevant parts of your information to Anthropic's AI models: your messages to Q, your brief and answers, figures you uploaded, and the analysis built from them. Some market-research steps also use web search, which can include your company name or industry. PerfIQ does not use your content to train AI models and does not give it to anyone to train theirs. PerfIQ sends this content to Anthropic's API, and Anthropic handles it under its own terms.

Learning across companies

PerfIQ gets better by learning from many companies together, in de-identified and aggregated form. What is shared is patterns, such as industry, size band, the pattern found, scores and ranges for business metrics. It is never your company name, your people, or your brief or chat text. Demo, sample, test, staff and internal accounts are left out, and so are diagnoses without enough evidence. This is on by default for real customers; to opt out, write to legal@theperfiq.com. If you delete your account, the learning records tied to it are deleted too. The Privacy Policy has the full wording.

Uploads

Spreadsheet uploads are checked before anything is saved: you see a preview, only valid rows are applied, a file over 5 megabytes or 5,000 rows is refused, and you can undo an import for 7 days. Files go to private storage and are removed if you delete your account.

Sharing reports

You can create a link to share a report with someone outside PerfIQ. A link expires after 30 days and can be turned off at any time. You can also add a passcode as an extra step, but a passcode is short and is not strong protection, so treat the link itself as the secret and share it only with people you trust. Anyone who has the link (and the passcode, if one is set) can see that report. Shared pages are marked so search engines do not list them.

Who at PerfIQ can see your data

Only people at Think. Do. Thrive., LLC who need it to run, support or secure the service. Opening an account page in the staff tools is written to a log. Not every staff view of customer text is logged yet. PerfIQ also keeps a record of sign-ins, account creation, exports and deletions, with dates and no content. These records are not yet deleted on a schedule.

Protection against abuse and runaway usage

PerfIQ limits how fast new accounts can be created, how many chat messages one account can send per minute, and how often public pages can be hit from one network. It also keeps a daily limit on AI usage across the service, raises an alert to the team as it approaches that limit, and can pause new AI work immediately if something looks wrong. Free accounts have their own usage limits.

Frequently asked questions

Is PerfIQ SOC 2 or ISO 27001 certified? No. PerfIQ has not been through a formal certification or an independent audit, and does not claim otherwise. This page describes what the product does today.

Can other customers see a company's data? PerfIQ's own reviews and tests show they cannot. Your data is stored under your account, and every request is checked against the account that is signed in. The one way someone else sees a report is a share link that you create.

Does Anthropic train its models on customer data? PerfIQ does not use your content to train AI models and does not give it to anyone to train theirs. PerfIQ sends your content to Anthropic's API, and Anthropic handles it under its own terms; read them if this matters to your team.

Is the cross-company learning anonymous? It is described as de-identified and aggregated, not as anonymous. Only patterns leave your account, never your name or text, and the records behind them are kept under an internal account number rather than your company name.

Can data be deleted? Yes. Write to legal@theperfiq.com to export your company's data or delete your account. Deleting removes your conversations, briefs, diagnoses, plans, uploaded files, share links, usage records and learning records, cancels any paid plan and removes your records at the outside billing, sign-in and contact-management services PerfIQ uses (the Privacy Policy names them; if one is unavailable, PerfIQ keeps trying for up to 30 days, then staff finish it by hand). Payment records that the law requires, support tickets already held by those services (removed on request) and copies in the providers' recovery systems can remain for a time.

What happens if there is a security incident? If PerfIQ learns of a breach that affects you, it will tell you as the law requires.

Report a security concern

If you think you have found a vulnerability, or suspect someone has used your account without permission, write to security@theperfiq.com (or to legal@theperfiq.com). Please allow a reasonable time to fix a problem before sharing it publicly.