Keeping each company's data separate

What this covers

Diagnoses, plans, decisions, reports, conversations, notes, uploaded files, shared-link records and Vitals belong to one account and one company.

A second company in your account has its own set.

If PerfIQ cannot tell which account or company a request belongs to, it stops instead of showing data from every company.

PerfIQ takes your staff status from its stored account record and a fixed list of staff email addresses, not from anything your browser sends.

How we check

Our automated tests sign in as two customers, as a staff member and as a signed-out visitor, plant marker text in every kind of record, and call each page and data route in an internal route table using the first customer's identifiers.

The tests fail if any marker comes back to the wrong person.

A separate scan fails the build when a database query on company data does not say which company it means, unless a person has reviewed and listed it.

We also reviewed the code for every kind of data above in October 2026.

What we have not proven

The tests run on our own test data, and they do not replace an independent test of isolation, which has not been done.

Sharing a report

You can share a report by link, and the link is a long random value that cannot be guessed.

A link expires after 30 days, and you can turn it off at any time.

You can add a passcode; a passcode is a convenience, not strong protection, so share links only with people you trust.

Someone with the link sees the full report as you print it, including your company name and, if you set one, your firm name and logo, and nothing else in your account.

Shared pages are marked so search engines do not list them, and browsers are told not to store them.

PerfIQ does not show you who opened a link.

Who at PerfIQ can see your data

Two named PerfIQ people have staff access (see Security).

They can open your account page to support you or check quality, and opening an account page is logged.

Some other staff pages that show customer text are not logged yet.

Staff tools include a customer view that shows the product as a customer sees it, and it works only for staff accounts.

What we do not do yet

• We have not had an independent test of isolation.
• We do not log who opens a shared link.
• We do not log every staff view of customer text.
• A shared-link passcode is stored as a one-way hash, and a link has no limit on wrong guesses beyond a general limit on views from one network.