At Futureproof we take security seriously. Ella is an AI-powered sustainability platform operated by Futureproof Tech Ltd, and protecting customer data is a core part of how we build and operate the product.
The goal of Ella is to become a core part of your sustainability and ESG tech stack, a place where you can store documents, manage workflows, analyse data and move faster with confidence. That only works if customers can trust that their data is handled carefully and that sensible technical safeguards are in place.
This page explains how we currently approach security across Ella. If you have any additional questions, please contact support@poweredbyfutureproof.com.
Ella's core application infrastructure is built on Supabase, which provides our primary database, authentication, storage and edge function runtime.
Our primary application data is hosted in:
This means the main Ella application data, including database records, authentication data and stored customer files, is hosted in the UK.
In addition to our core infrastructure, some third-party providers used to deliver specific features may process data outside the UK or EEA, including certain AI providers, transactional email providers and browser automation tools.
Data transmitted between users and Ella is encrypted in transit using HTTPS.
Data stored within our core infrastructure is encrypted at rest at the infrastructure-provider level. This protection is provided through our managed hosting and storage providers rather than configured directly in the application code.
Ella uses Supabase Auth for user authentication and session management.
Security controls currently include:
Access permissions are structured by role, including master, admin and team permissions where relevant.
At the data layer, row-level security policies are used to ensure users can only access data belonging to companies they are authorised to access.
Ella is a multi-tenant platform. We enforce company-level isolation through database membership checks and row-level security policies.
This means users can only access company records, files and workflows where they are recognised as an authorised member of that company.
Customer-uploaded files are stored in private storage buckets and require authenticated access.
Private storage buckets are used for items such as:
Certain non-sensitive content, such as profile avatars, blog images and help videos, may be stored in public buckets where appropriate for product functionality.
Where customers choose to configure certain third-party workflows, sensitive credentials may be stored using encrypted secret-management infrastructure.
For example, B Corp login credentials are stored using Supabase Vault and accessed only through controlled server-side functions with company membership checks.
We do not expose these credentials in client-side code.
Application secrets and provider API keys are stored server-side using managed secrets infrastructure.
These include keys for services such as:
These secrets are not exposed in client-side code. The only client-side keys exposed are publishable keys intended for browser use, such as the Supabase anon key and public marketing tracker identifiers.
Most Ella edge functions require JWT authentication before they can be used.
Some public or semi-public flows, such as invite validation, public signature flows, scheduled tasks or specialised admin flows, use alternative controls such as signed tokens or shared secrets. These routes are more limited in scope and do not rely on normal user JWT authentication.
Ella includes an audit logging system that records significant user and system actions across the platform.
Logged events may include:
Audit records are linked to timestamps, user context and relevant metadata to support traceability and incident investigation.
Ella uses third-party AI providers to power specific product features such as chat, summarisation, document parsing, data extraction and retrieval.
These providers may include:
These providers are used to process customer content only where needed to provide the requested functionality.
Where OpenAI API services are used, OpenAI states that API data is not used to train its models by default.
Operational emails such as invitations, password resets, welcome emails and signature requests are sent through Resend.
These communications contain only the information necessary to support the relevant workflow.
Certain customer-enabled workflows, such as B Corp-related automation, may use browser automation infrastructure.
These workflows rely on third-party services such as Browserbase and related worker infrastructure. Where used, credentials and session data are handled through controlled server-side processes rather than exposed directly in the frontend.
Ella currently includes the following application-level security controls:
Some security measures, such as HTTPS enforcement, are provided through our hosting and infrastructure providers.
Ella currently supports deletion of certain categories of customer data through the product, including individual files, documents and some workflow records.
Some other deletion activities currently require manual support, including:
Where documents have been indexed in AI retrieval systems, deletion may require separate technical cleanup steps.
We rely on managed infrastructure providers for backup and recovery capabilities.
Specific backup retention periods and disaster recovery configurations are determined at the provider level and are not fully managed through the application codebase.
We continue to improve the security posture of Ella over time.
At present, we do not publicly claim formal penetration testing, external security certification, or a fully documented automated security testing programme unless and until those are completed and verified.
Where security issues are identified, we review and address them as part of our product and engineering process.
If we become aware of a security incident affecting customer personal data, we will investigate it, take reasonable steps to mitigate it, and notify affected customers where required by applicable law and our contractual obligations.
Ella relies on a number of specialist providers to deliver infrastructure and functionality securely. These include core infrastructure providers, AI providers, transactional email providers and workflow-specific services.
You can find more information about how we use third parties in our Privacy Policy and Data Processing Addendum.
If you believe you have discovered a vulnerability in Ella or have a security issue to report, please contact support@poweredbyfutureproof.com.
Please include as much relevant detail as possible so we can investigate effectively.