Who else is involved, and why.
Every piece of software relies on other software. This is what FaireSight is built on — the whole list of who touches any part of this, in English. It’s our tech stack, not a set of endorsements: none of these companies vouch for us, and naming them says nothing about what they think of FaireSight.
Where FaireSight runs — the same infrastructure behind most of the software you already use every day.
The AI that writes your brief and answers your questions.
Delivers the emails you choose to send to your stores.
Handles billing. We never see your card number.
Signing in, and sending you your morning brief.
Where your order data comes from, through their official connection for brands.
Each company name above is that company’s trademark, used here only to say factually which services FaireSight runs on. We’re not affiliated with, sponsored by, or endorsed by any of them — Faire included.
If you want the technical detail — or your IT person does click to open
Tenant isolation. Every brand’s rows are separated by PostgreSQL row-level security. It’s forced on and runs under a database role that cannot bypass it, so isolation doesn’t depend on us getting every query right. Credentials are stored per tenant, never pooled and never shared across brands.
Application security. Built to OWASP ASVS Level 2. Strict content security policy and hardened response headers on every page; audit logging on sensitive actions; access tokens hashed at rest, never stored in plaintext; TLS with full certificate verification; sessions scoped, short-lived, and bound to their tenant; passkeys / WebAuthn on the retailer portal.
Transport. The site and every retailer portal are HTTPS-only. Plain http is redirected at the load balancer before it reaches the application, and HSTS is served with a one-year max-age and includeSubDomains — so once a browser has seen the site, it refuses to make an unencrypted request to any subdomain at all, rather than being redirected after the fact.
Infrastructure. Application and database run in private AWS subnets with no direct public exposure. Secrets live in AWS Secrets Manager with automatic database credential rotation. CloudTrail captures API and infrastructure activity; GuardDuty watches the account for suspicious behaviour.
Paperwork. A signable data-processing agreement and a maintained subprocessor page are still being finished. We would rather say that plainly than publish a placeholder — if your team needs either to sign off, ask and we’ll walk you through exactly where things stand.