Privacy

What this covers

This notice covers firmus.sh (this site), console.firmus.sh (the console) and api.firmus.sh (the API) — the three surfaces personal data can reach. The legal notice names who publishes them; this page names what they do with data, and for how long.

If you sign in to the console

An account is an email address, a bcrypt password digest, an optional name, and a field for confirming the address that nothing writes yet — email verification does not exist, deliberately, at this stage.

Signing in creates a session record on the server rather than only a cookie: an id, signed and carried in a cookie that is httponly, sent only over HTTPS in production, and sent only with same-site navigation. The record also carries the IP address and the browser's user agent from the moment you signed in.

A session authenticates for up to thirty days from when it was created — a fixed window, not one that renews on activity. The record, IP address and user agent included, is deleted when it expires: a nightly pass removes every session past its own expiry, so thirty days is how long the record is kept and not only how long it works. Signing out deletes it sooner, and deleting your account deletes every session on it.

API keys

Creating an API key does not store the token you are given. It is shown once, at creation, and there is no way to recover it afterwards. What is stored instead is a salted digest of it, plus a prefix and its last four characters — enough to show the key in a list, not enough to reconstruct it.

Revoking a key does not delete its record. It is marked revoked and kept, so a key that was used can still be identified later, by its prefix and last four characters, without the token itself ever having been recoverable.

Usage

Two counters on our API server record that a call happened: one for the month, one for the day, each keyed to the organization and to nothing else — not to a key, not to an address, not to a request. Each call is a single increment on each, and each counter is deleted 40 days after the last call it counted. Nothing is sent to Stripe. A paid tier is a flat monthly fee and no call is billed on any tier, so there is no usage to bill and no ledger of usage anywhere; what the two counters are for is the free tier's monthly allowance and the usage screen in the console, which shows a monthly total and a daily chart. There is no table of individual requests on this side, so nothing finer than those two figures exists to show.

The live tail

While the console is open, a feed of the organization's own traffic can be watched arriving in real time. Nothing about it is stored: it is broadcast with no subscriber list to remember, and reopening the console starts an empty feed rather than replaying anything. Each event on it carries a timestamp, the method, the path that was called, the response status, the latency, and the last four characters of the key that made the call. The path is the one that was requested, query string included, so a lookup of one company appears in the feed as that company and a search appears as the term that was searched for. One thing is removed first: an API key sent as a query parameter, which is replaced before the event is broadcast. The feed is readable by every member of the organization whose key made the call, and by nobody else.

The public demo key

The search box on this site and the "try it" panels in the documentation share one API key, capped at 100 calls a day for each calling address. That cap is tracked by a counter keyed to the demo key's own organization and your calling address together, not to the address alone; the counter holds the address itself, unhashed, and expires at the end of the day (UTC) it was created. That is the only use an address is put to on this path. A key of your own, once you create one, shares nothing with anybody else's traffic.

Because that key belongs to an organization, a search made here or in the documentation reaches that organization's live tail — the feed described above — as the term that was typed, for as long as somebody has the feed open. Your calling address is not part of the event, and nothing about it is stored: it is broadcast and gone.

Logs

Every request is logged — Rails' own stock logging, tagged with a request id, written to standard output. The line carries the HTTP method, the path, and the calling IP address. Two things are removed before it is written: an API key, whether it arrived as a header or in the query string, and the search term sent to the autocomplete endpoint. Neither reaches the log in a readable form.

Nothing configures a retention period for these logs anywhere in the repository, so treat them as transient operational records rather than an archive with a known lifetime.

Payment

Stripe is the payment processor, and the only place a name, a billing address or a VAT number collected at checkout is stored — Stripe Checkout and the Stripe customer portal collect them directly, and this side keeps none of it. What is kept locally is an identifier for the Stripe customer and the subscription, the plan, and the date the current billing period ends. A Stripe customer is not created until it is needed — the first visit to Checkout or to the customer portal — so an organization that has visited neither has no Stripe customer at all.

This site

firmus.sh sets no cookie of its own, and nothing on it tracks a visitor across a session or across visits. It writes nothing at all to a browser's storage — not a cookie, not a localStorage entry, not even a display preference, which it used to keep and no longer does. Close the tab and the site has left nothing behind. That absence is also why there is no cookie-consent banner here: consent is only meaningful for something that needs it, and nothing on this site does.

The company data itself

Every record this site or the API returns comes from a national company register, published as open data — for France, INSEE's Sirene, distributed through data.gouv.fr under Licence Ouverte 2.0, whose one obligation is attribution. The source, the coverage and how fresh a record is are documented in full at Sources & coverage.

A record published in reduced form — no name, no address, partially_disclosed set to true — is not an error or a deletion on this side; it is the register's own diffusion partielle, and how it works and what it still tells you is documented separately at Masked records. A correction to what a record says belongs with the register that publishes it, not here — with INSEE, not with Firmus.

Your rights, and who to ask

Over your own account data, French and EU law gives you the right to access it, correct it, have it erased, and take a copy of it elsewhere. Firmus has not yet been incorporated (see the banner above and the legal notice), which means the entity that would receive that kind of request does not exist yet either — this page will carry an address to write to on the day it does. Until then, the CNIL, the French data protection authority (cnil.fr), can be reached directly about anything on this page.