Trust Center

FLAME is a workplace performance program for leaders and teams. The FLAME app is the measurement companion to the program: participants complete a short assessment, and the app produces individual and team reports.

The app is small by design. It holds the minimum data needed to produce a report, runs on established cloud infrastructure in Australia, and is maintained by a single named operator. We don't hold payment data, we don't sell or share participant data, and we delete it when the engagement ends.

Operator: Dash Media Limited, a New Zealand company (NZBN 9429047432260). Registered office: 242a Oceanbeach Road, Mount Maunganui, Bay of Plenty 3116, New Zealand.

Security contact: hello@flame.live. Response within one business day.

Participant data is stored and processed in Australia. Static assets (fonts, images, scripts) are served from Vercel's global CDN; no participant data passes through the CDN. The operator works from New Zealand.

We don't collect: passwords (sign-in is by one-time code), payment details, dates of birth, health information, government identifiers, or device identifiers beyond standard server logs.

The assessment measures workplace performance factors such as energy, focus, and sense of purpose. It is a development tool, not a clinical instrument. An individual's results reach their employer or coach only if that person switches sharing on; the join screen says so before they enter an email address, and the choice can be reversed at any time from the app's Sharing page.

Participants sign in with a one-time code sent to their work email address. No password is created or stored. Sessions are managed by Supabase Auth: the access token is renewed every hour over TLS, and a session lasts until the person signs out.

Administrative access to Vercel, Supabase, GitHub, and the operator's email is limited to one person (the operator) and protected by multi-factor authentication on every account. There are no shared accounts. Database access is through the Supabase dashboard or authenticated API only; there is no public database endpoint.

Inside the app, Row Level Security policies in the database restrict every participant to their own records, and team administrators to their own team's aggregated data.

See the full table at /trust/subprocessors. In short: Vercel (hosting), Supabase (database and authentication), GitHub (source code), Anthropic (AI-generated report narrative), and Twilio SendGrid (the sign-in email). Each publishes its own compliance documentation, linked from the table.

What we send to the AI provider: assessment scores and the factor labels needed to write a readable narrative. We don't send names, email addresses, or organization names. Anthropic's commercial terms prohibit training on this data, and inputs are deleted from their systems within 30 days.

A subprocessor is a third party that stores or processes participant data on our behalf. This list is current as of 27 October 2026. We update it before adding a new subprocessor and keep a dated change log at the bottom.

Infrastructure beneath the subprocessors

Supabase runs on Amazon Web Services (ap-southeast-2). Vercel runs on AWS for serverless functions. Both providers' compliance documentation covers their use of AWS.

What we don't use

No advertising networks, no data brokers, no session-recording tools, no error-tracking service, no third-party cookies, and no analytics on the app. The public site flame.live uses Vercel Web Analytics (cookieless page counts, no personal data), covered by the Vercel entry above.

Change log

• 27 October 2026: Initial publication. Vercel function region moved from Washington, D.C. (us-east-1) to Sydney (syd1).

• Participant data is kept for the duration of the client engagement. Deletion is on request: a client can ask for their team's data to be deleted at any time, and we action it within 30 days.
• Clients can request deletion of their team's data at any time. We action requests within 30 days and confirm in writing.
• Participants can request a copy of their data or its deletion by emailing the security contact. We verify the request against the account email before acting.
• Backups are retained for 7 days and roll off automatically, so deleted data leaves backups within that window.
• Aggregated, de-identified statistics (no names, emails, or team identifiers) may be retained for research and benchmarking.

• Encryption in transit (TLS 1.2 or higher, HSTS enforced) and at rest (AES-256 on Supabase and its backups).
• Multi-factor authentication on every administrative account.
• Row Level Security on every table holding participant data.
• Secrets stored in Vercel and Supabase environment configuration, never in source code.
• All changes go through GitHub with a preview deployment reviewed before production.
• Dependencies monitored by GitHub Dependabot; security patches applied promptly.
• Daily automated database backups in the same region.
• Logs don't contain assessment responses or sign-in codes.
• Policies reviewed at least annually and after any significant change to the app.

What we don't have, so you don't have to ask: an in-house SOC 2 or ISO 27001 certification. We rely on the certified infrastructure of our subprocessors (linked above) and keep our own footprint small enough to describe on one page.

Email hello@flame.live. Include what you saw, where, and when. We acknowledge within one business day and keep you informed until it's resolved. We don't take legal action against good-faith researchers who report responsibly.