f13i is a one-person pricing consultancy. This page describes how client material is actually handled, and exists so a security review can be answered with a link instead of a questionnaire. If your process needs the questionnaire filled in anyway, email me@f13i.com.
One person: Farhan Manjiyani. f13i has no employees, no contractors and no offshore staff. Nobody else has access to client material. If that changes — a subcontractor on an engagement, for example — affected clients are told before any data is shared, not after.
Working notes, deal files and models are held in an encrypted local vault synced through Apple iCloud. Email, documents and calendar run on Google. Call recordings and transcripts, when a client has agreed to recording, are held in Granola. Signed agreements are in SignWell; invoicing and payment in Stripe and QuickBooks. Each of these is named in the subprocessor list with what it holds.
All transfer is over TLS. Client material is not sent over unencrypted channels, and is not posted to public repositories, forums or model-training datasets.
f13i uses AI tooling in its analysis work, including Anthropic's Claude. Client material processed this way is handled under commercial terms in which inputs and outputs are not used to train models. AI tooling is named in the subprocessor list like any other processor, because that is what it is. If your agreement restricts AI processing of your material, say so before the engagement starts and the workflow will be adjusted.
API keys and access tokens are stored in local environment files excluded from version control, never committed to a repository and never shared. Client credentials are not requested. Where access to a client system is genuinely needed, it is scoped to the minimum required and revoked at the end of the engagement.
Client material is kept for the life of the engagement and afterwards only as long as it is useful to an ongoing relationship or required for business and tax records. On written request, client material is deleted and deletion is confirmed in writing — subject to records that must legally be retained. Email me@f13i.com.
If client material is exposed or accessed without authorisation, affected clients are notified without undue delay and in any case within 72 hours of f13i becoming aware, with what is known, what is affected and what is being done.
These practices are described here for reference. Contractual obligations — confidentiality, data processing, liability, insurance — live in the signed agreement, and the agreement governs where the two differ. See also the privacy policy.