Data and security, one question at a time.

Whoever is in the place where you put it: Private, a team, a space or the Home. Plus whoever you give access to. Only you see your Private, and not even whoever leads the organization gets in. The database decides on every request, not the screen.

They are two of the organization’s base roles, along with Member and Guest (which exists only if the organization allows guests). Lead can do everything (the settings, who leads, deleting the organization) and also sees the spaces it is not in, but nobody’s Private. Administers invites and removes people and changes their role, but not the settings.

Yes. What would they see…? answers in words, for example “Can read and export; cannot edit”. And if you move a page to a wider space, it says first who will see it: “The 12 people in Sales will see it too. Move it?”. Where you cannot, it says “Not here” and why.

Yes. In the sharing window choose For how long: forever, a week, a month. Next to the name the date it ends appears, and on that date it ends. If it is no longer needed before then, you remove it whenever you want.

Only what the link opens. Whoever fills in a form or books a meeting sees a public page. Whoever joins a call sees the room: the faces, the screen, the questions, the notes. They do not see conversations, spaces, whiteboards or Pan. The link to join lasts twelve hours and can be cancelled.

Only you. A mail linked to a page shows the page the link and a summary, not the text. The events of outside calendars sit among yours, and only you see them. With Gmail and Outlook you sign in with the provider’s own access; where an app password is needed, it is locked away and used only for your mail.

With email and password, or with a link that arrives by email and works once: if it has expired or was already used, you ask for another. Continue with Google and Continue with Microsoft appear only where whoever runs the service has turned them on. The account is born with the invitation, with no password to invent, and sign-ups are by invitation until they open. Two-step verification is there: an app gives a six-digit code and, if you turned it on from the Profile, signing in needs that code too. Whoever leads the organization can ask everyone to use it.

A column of a table with a padlock. Its values are read and written only by whoever has the Read reserved fields capability. By default whoever manages has it, and a role you write can give it to whoever needs it. Making a column reserved can be done by whoever manages the table; removing the restriction, only by whoever reads its values.

No. They do not show in searches or in the history, and Pan never writes in a reserved field. An external assistant does not read or write them, not even for someone who can read them. A rule that notifies an outside service sends only the row’s name, and never from a reserved row.

Pan’s key, the services’ secrets and the mailboxes’ passwords are sealed by a separate service, the vault, and not by a person’s editor, where the terminal runs too. They are sealed as soon as you write them and open only for you, in the service that uses them, for the time needed. They cannot be read back. You change or remove Pan’s key from Pan’s key, in Settings, Account, Pan.

Every access given, changed or removed, and every action done on behalf of an assistant, a job, a channel or the phone: who, which action, when. Never the content, neither text nor values. A line once written is not changed or removed. What you do by hand is not in it: for a document, the history tells it.

Everyone reads the lines of what was done on their behalf: for an external assistant they are under What it did. Whoever has the “See everyone’s work” permission also reads those of the whole organization.

Yes, one minute at a time, and only for the page you have in front. The members of the space where you worked see it, and whoever has the “See everyone’s work” permission. After 90 days the minutes become days, and after a year they are removed. How often you use Pan you see yourself; whoever has that permission sees it too, in Statistics, for the 7, 30 or 90 days they choose.

Yes. A document’s history shows its moments and who wrote each, and Restore here puts the text of that moment back as an ordinary edit: others see it, it can be undone, and the history stays. What you remove goes to the Trash and from there you take it back. A Communication post is not deleted, it is discarded, and an external assistant deletes nothing. Deleting the organization, instead, is forever and for everyone: only the Lead can do it.

The simple signature is an electronic signature: it says who was signed in to Fallthere with their account when they signed. You draw or write it in the viewer and place it where needed. It is not a digital signature with a certificate. Digital signature uses the certificate you hold from your remote signing provider, with the Cloud Signature Consortium standard: only the fingerprint to sign goes to the provider, and password, PIN and code are not saved. The button is there only where a provider has been set.

Yes, for .p7m files and signed PDFs: they open in the viewer and say, one line per signature, who signed, when and whether the document is really the one that was signed. At the bottom it says what Fallthere does not check yet: whether the certificate was revoked and the European list of trusted authorities. A signature is “good” only if everything that is checked adds up.

It is not decided yet, and what is not decided we do not write. Fallthere is not open to everyone yet: when it is, where each organization’s data lives we write in Security and data, precisely. Today we can say where this site is: on a Contabo GmbH server, in Munich, in Europe.

No, none for now, and we do not write acronyms we do not have. Whoever answers for the data is Firmamento Technologies; its details are in the legal notice. For a security problem, write to info@firmamentotechnologies.com, with “Security” in the subject.

No. It uses no cookies, has no analytics tools and loads nothing from other people’s servers: fonts, styles, images, videos and a little JavaScript of ours, which collects nothing, sit on our own server. Like any server, it may keep technical logs of requests, with IP address and time. How long it keeps them is not in the legal notes yet. The “Book a demo” buttons open your mail with a message already written, and the site receives nothing.

What you see, and only where you have the Use Pan capability: the open document and the text you selected, attachments (up to three), and what it finds by searching the pages, your mail, messages, calls and meetings you can read. In Messages it reads only if you call it with “@Pan”; with Write with Pan it receives only your draft. What needs doing? hands it the mail without the recipients’ addresses.

The text needed to answer, to the provider you chose (OpenRouter, EUrouter, OpenAI, Anthropic, Google or DeepSeek), with your key. Their terms and privacy notice are the provider’s: Fallthere has no key of its own in between. For EUrouter the guide Pan’s key speaks of models computed in Europe. Mails, pages and files reach the model between boundary marks, as text to read and not as instructions. With search on Local, the question does not go out to the web.

No: to write it asks permission, in the words of what it is about to do. You answer Yes, this time, Yes, for this conversation or No. A Yes, always is your own choice: it is written under “What it does without asking”, in Your Pan, and you remove it with a tap. The tools that read, Pan uses on its own. An agent that “only prepares” does not have the ones that write, and in background jobs nothing starts that asks for permission.

An assistant such as Claude Code or Cursor works as the person who gave it the code: it reads where you read and, if the code writes, creates and changes rows, assigns, creates pages and builds apps. It deletes nothing. It does not go where Use Pan is missing, and does not touch reserved fields, the People table or conversations. The code is shown once and only its fingerprint stays in the database; Remove turns it off at once, and what it already did stays in the log. If you leave the organization, your assistants lose access.

Pan answers you, in a conversation of your own, for example “Pan from Telegram”, and only in direct messages, never in groups. It works with your key and your cap. Each person connects with their own code, the platform’s signature is checked on every message, and whoever leaves the organization no longer talks to Pan from there. The message still passes through the platform you use, with its rules.