Trust & security.
1. Architecture
AskFolder is a static web page. The browser reads the user's files, builds the search index and answers questions on the user's computer; its AI model is downloaded from askfolder.com and runs there too. There is no AskFolder server, database or upload endpoint, so there is no customer data at rest with us and nothing for us to breach, lose or be compelled to disclose.
2. Enforcement
askfolder.com is served with a strict Content Security Policy: the page may load only its own files and may send data nowhere (connect-src 'self'). This is checkable by anyone in the browser's developer tools.
3. Payments
AskFolder Pro is sold through Paddle, merchant of record. A Pro license is signed by a small Cloudflare Worker after Paddle confirms the payment; it carries a subscription or order ID and an expiry date (none for Pro bought once), nothing else, and is checked by the page itself, offline.
4. Certifications
We hold no SOC 2 or ISO 27001 certification. Given the design above, there is no customer data in our systems for such an audit to cover.
5. Reporting a vulnerability
Email security@rptxsoftware.com (for AskFolder, security@askfolder.com). We answer within two business days, fix what's real, and credit you if you'd like.