Trust and security
What a security review will ask, answered in one place.
Written in plain language and kept honest. If something you need is not here, email info@forbetra.com and we will answer it directly.
Who we are
Forbetra is built and operated by Winning Mind, LLC, 2358 University Ave., #265, San Diego, CA 92104, a performance psychology practice founded by Marc Sagal. Forbetra is its first software product.
Where your data lives
The application runs on Vercel and the database is hosted by Neon in the United States (us-east-1). Data is encrypted in transit and at rest.
Certifications
We have not completed a SOC 2 audit. We will complete your security questionnaire, sign a data processing agreement, and walk your security team through the architecture.
Retention and deletion
Journey data is kept while the account is active. Athletes must be 13 or older. Account holders can request deletion of their account and data at any time; organizations can request deletion of all participant data at the end of a pilot. Full detail in the privacy policy.
Operations
The database is backed up continuously with point-in-time restore. For organizational pilots, Winning Mind acts as processor and the organization as controller, set out in the data processing agreement. We tell pilot partners before adding a subprocessor. Report a security concern to info@forbetra.com and you will hear back within one business day.
Accessibility
We are working toward WCAG 2.1 AA across the product and this site, and test with keyboard navigation and screen readers. Report a barrier to info@forbetra.com.
Support
Email support at info@forbetra.com, replies within one business day, Pacific time. Pilot partners get a direct line to the team.
Subprocessors
Every third party that processes data on our behalf, and what reaches it.
| Provider | Purpose | Data |
|---|---|---|
| Vercel | Hosting and delivery of the application | Request logs and application data in transit |
| Neon | Database hosting (PostgreSQL, United States) | All application data at rest |
| Clerk | Authentication | Name, email, login credentials and sessions for account holders |
| SendGrid and Postmark | Email delivery | Email addresses and the content of notification emails |
| Twilio | SMS delivery, only when a phone number is entered | Phone numbers and the content of SMS notifications |
| Anthropic | AI summaries and coaching briefs | Ratings, notes and names within a journey, sent to generate a summary. Not used to train models. |
Legal documents: Privacy policy, Terms of service, SMS consent. Data processing agreement on request.