Legal

Security

Last modified: October 1, 2026

Where things stand

Fycus is in development. The product described on this site is under development and is not yet available, so this page describes two things separately: how the public website and its early-access form are protected today, and what we are designing the product to do. We will update this page as the product is built.

The public website

• The site is served only over HTTPS. Plain HTTP requests are redirected, and browsers are told to use HTTPS only.
• The site is a set of static files. It has no logins and no accounts.
• Security headers are set on every page, including a strict Content Security Policy that allows scripts only from fycus.ai and, if you allow analytics or advertising, from Google Tag Manager and Google Analytics and from the Meta, Reddit, Microsoft, and any other advertising tools named in the Privacy Policy. Other sites cannot embed our pages in a frame.
• Analytics and advertising tools load by default; the Your Privacy Choices link in the footer lets you turn them off at any time. We honor a Global Privacy Control signal, which turns them off automatically and cannot be overridden.

The early-access form

• The form is built to send your information over an encrypted connection to our own API at forms.fycus.ai, and to store what you submit in an encrypted database. Until the form is connected, nothing is sent or collected at all; the page tells you so if you try to submit.
• Once it is collecting information: email addresses are handled with care, we do not put them in our logs, and analytics never receives what you type into the form.
• We ask only for what we need to contact you and to learn what would help your board. Please do not enter confidential or privileged information in the form.

The product (in development)

These are design goals, not features you can use today. We will not describe a safeguard here as in place until it is built and we have checked it.

• Encryption of data in transit and at rest.
• Access restricted by role, so that board-only documents stay board-only, with a visibility level on every document and a log of who accessed what.
• The product's records kept apart from this marketing site, with no analytics or advertising tags inside the signed-in product.
• AI-assisted features that draft or summarize for a person to review. A person reviews AI output before it is sent.

Certifications

Fycus does not currently hold a third-party security certification or audit report (such as SOC 2, PCI DSS, or ISO 27001), and we make no claim that it does. We will not describe Fycus as certified until it actually is. Fycus does not collect or store payment card information.

Report a security issue

If you believe you have found a vulnerability in fycus.ai or forms.fycus.ai, please email security@fycus.ai with enough detail for us to reproduce it. Our contact details are also published at /.well-known/security.txt.

• Please give us a reasonable chance to fix the issue before you share it publicly.
• Please test only against your own data, and do not access, change, or delete other people's information, disrupt the service, or use social engineering.
• We will acknowledge your report, keep you informed, and will not pursue action against research done in good faith under these guidelines. We do not currently offer a paid bounty.

Questions

For anything else about how we handle information, write to team@fycus.ai.