Your unreleased logos stay yours.
What we do today to protect them, written plainly. We also list what we do not have yet.
Sign-in without passwords
Owners sign in with a six-digit code sent to their email. Codes expire in ten minutes, allow a few tries, and are rate limited. Sessions are signed and can be ended on every device.
Private by link and code
Boards are not listed or searchable and are hidden from search engines. Add an access code to keep a board to your own people. Repeated wrong codes lock that visitor out for a while.
Cards never touch us
Payments are handled by Stripe on its own page, including Apple Pay and Google Pay. We never see or store card numbers.
Safe uploads
Images are checked by their contents, not just their file name, re-encoded in your browser, and served in a sandbox.
Hardened by default
HTTPS only, a strict content security policy, protection against cross-site requests, and no third-party scripts or ad trackers on the product.
Protection for artists
Proofs are watermarked with the viewer’s name. Originals never leave the server until you release them. Every file gets a signed, dated fingerprint you can verify publicly. These deter and document; they can’t stop someone photographing a screen.
Tested by attacking it
We wrote and run attack tests against the product (forged sessions, impersonation, malicious uploads, brute force, cross-site requests, replayed payment events). Findings were fixed, and the remaining accepted risks are written down in plain words.
You control your data
Export any board as a file. Delete a board or your whole account yourself, from your dashboard, and the data is removed.
What we do not have yet
Roundfy is a young product from a small team. We do not yet offer single sign-on, detailed audit logs or a SOC 2 report, and we do not make compliance claims we cannot back. If your company needs any of these, tell us what you need on the contact page. It shapes what we build next.
Where data lives
Account details, boards and images are stored with our hosting provider, Netlify. Email codes are sent by an email delivery provider and payments by Stripe. See the privacy page for the full list.
Found a vulnerability?
Please tell us through the contact page and give us a reasonable time to fix it before sharing it publicly. We will acknowledge your report and keep you updated.