Perfingo
How is each client’s data kept separate?
Isolated by household
You only see households where you hold a seat. Each client’s session is fully isolated from every other’s.
Enforced on the server
Every access rule is checked on our servers, not just hidden on your screen. Hiding a button is only for convenience. The server is what actually blocks anything you shouldn’t see or change.
Removed, not wiped
Something removed, a seat or a record, is marked removed rather than erased, so the history stays complete. The exception is a client who deletes their own account from Profile: that permanently deletes their plans and data.
Is my session recorded, and what analytics are sent?
Separately from client data, the app sends analytics events to PostHog and records sessions. This is worth knowing before you open a client’s plan in front of them:
- Recordings are not masked. A recording shows what was on screen, figures included, so a session in a client’s plan shows that client’s numbers. This is deliberate (a blurred recording can’t answer “was this field wrong?”), and it’s disclosed in the privacy policy. There’s no in-app switch to turn it off.
- Events carry no amounts. The analytics stream is a closed list of screens and actions with yes/no flags and short words, never a figure, household, or plan identifier. Your own account id is sent; nothing else identifies you or your clients.
Tell clients this the way you’d tell them about any other recording. It applies to your seat exactly as it applies to theirs.
For the client’s view of the same recording and data rules, see Plans, saving and your data.