Security at PerfIQ

Signing in

PerfIQ uses WorkOS for sign-in, so PerfIQ does not store a password of yours.

New accounts need a work email address; personal and disposable email addresses are turned away, and PerfIQ staff can approve an exception for a named address or domain.

Each sign-in attempt carries a random single-use value that PerfIQ checks when you return, so a sign-in link made by someone else is refused.

Your session

After you sign in, your session is held in a cookie that page scripts cannot read, and it only travels over encrypted connections.

A session lasts 12 hours.

When you sign out, PerfIQ ends your session on its side and asks its sign-in provider to end your sign-in sessions as well.

That request to the provider is made in the background with a short time limit and is not retried.

Protection for requests

A request that changes data is refused when it comes from another website.

Signing out also refuses a request that starts on another website.

Ordinary requests are capped at 1 MB and uploads at 12 MB; PDF attachments are capped at 10 MB and spreadsheets at 5 MB.

Encryption

Pages are served over HTTPS, and every page tells browsers to keep using HTTPS.

PerfIQ calls its service providers only at HTTPS addresses.

As of 2026-10-30, Cloudflare states in its public documentation that data stored in its database and key-value services is encrypted at rest (database, key-value).

PerfIQ does not manage those keys.

The device addresses used for push notifications are encrypted by PerfIQ before they are stored.

Who can use staff tools

Two named PerfIQ people can use staff tools.

Staff sign in the same way you do, and the staff role is given only when the sign-in provider reports a verified email address.

Limits on abuse

PerfIQ limits how often sign-in can be started or completed from one network, how many accounts can be created each hour, how often shared pages are created or opened, and how many uploads one network can make.

It also limits how many chat messages one account can send each minute, and how many support messages, questions and document uploads one account can send each hour.

The service as a whole has a daily limit on AI usage, and staff can pause new AI work at once.

Protections in your browser

Pages are sent with standard protective headers, including one that stops other websites from showing PerfIQ inside a frame.

A full content-security policy is not in place yet.

Activity record

PerfIQ keeps a record of sign-ins, account creation and deletion, deletions of diagnoses, plans, briefs and companies, company exports, uploads, acceptance of the terms, and staff opening an account page.

Each entry holds who did it, the action, the date, the network address and the browser type, and it does not hold your content.

We monitor PerfIQ's availability and get an alert when something is wrong.

Reporting a problem

If you think you found a vulnerability, or suspect someone used your account without permission, write to security@theperfiq.com.

Please allow a reasonable time to fix a problem before sharing it publicly.

What we do not do yet

• We have no SOC 2 or ISO 27001 report.
• We have not had an independent penetration test; our reviews so far were done by us.
• We do not run a bug bounty.
• We do not scan uploaded files for malware.
• We have no written incident-response plan yet. If we learn of a breach that affects you, we will tell you as the law requires.
• Database backups are taken by hand before releases, and we do not yet take scheduled backups of customer data.
• Staff cannot yet sign someone out of every session from one control.
• An account has a single owner; separate roles for other team members inside one account do not exist yet.