Effective November 7, 2026

This policy explains what Prometheus Systems Consulting, LLC ("360Works", "we", "us") collects when you use The 360Works Console at console.360works.com and ReportCard, the FileMaker audit you run in it. It covers what we do with that information, who else handles it and how long we keep it.

What we collect

Your account

You sign in with a 360Works account, which Amazon Cognito runs for us. The same account works for other 360Works services. When you sign in, we receive and store:

your email address and, if your account has one, your name;
the account's ID, which links your records across 360Works services;
whether you belong to 360Works staff;
when you first and last signed in.

Cognito checks your password, passkey and authenticator code. We never see your password. To let you manage passkeys and your authenticator app on the account page, we keep each sign-in's Cognito tokens in our database, encrypted, for as long as that sign-in lasts.

We store which versions of our Terms of Service and this policy you agreed to, and when.

Your organizations

We store the organizations you belong to, their names, and your role in each: owner, admin or member.

Your audits

When you run an audit, we store:

the audit's name and the organization it belongs to;
the files you upload: FileMaker .fmp12 files, FileMaker XML exports, LayoutLogger logs and FileMaker Server settings exports, with their names and sizes;
the FileMaker account name, password and encryption key you enter for the free read;
your answers to the audit's questions, such as how the solution is hosted and how many people use it;
what the audit produces: the free read's counts, your quote, progress, the reports, an internal copy of the findings for our staff, a detailed log of the audit that includes the AI models' working sessions, and how much AI usage the audit cost us.

Your FileMaker files hold your solution's design, and .fmp12 files hold its records too. Those records may include personal data about your staff, your customers or other people. See "When your files hold other people's data" below.

Payments

Stripe takes your payment on its own checkout page. Your card number goes to Stripe and never reaches our servers. We store what Stripe tells us: the payment's amount, time and status, any refund, and Stripe's IDs for the customer, payment and checkout. We send Stripe your organization's name and the IDs of your organization, your audit and the tier you chose.

Cookies and browser storage

The console sets only the cookies it needs to sign you in:

Cookie	What it does	How long it lasts
`console_session`	Keeps you signed in	8 hours
`console_oidc_state`, `console_oidc_pkce`	Protect the sign-in round trip with Cognito	10 minutes
`console_oidc_return`	Remembers which page to return you to after sign-in	10 minutes, or an hour on Cognito's page for adding a passkey
`console_oidc_passkey`	Remembers which step of adding a passkey you are on	10 minutes, or an hour on Cognito's page for adding a passkey

Your browser also keeps your light or dark display choice. The console runs no analytics, advertising or tracking scripts, and it serves its fonts itself. The 360Works sign-in pages that Cognito runs may set cookies of their own.

How we use it

We use this information to:

sign you in and show you the organizations and audits you belong to;
read your files, price the audit and run it;
take payment and issue refunds;
support you and fix problems with your audits;
keep the service secure and spot abuse;
track what each audit costs us to run, and improve how we estimate prices from the free read's counts and the AI usage of finished audits;
learn who uses ReportCard: which people and organizations sign up and which audits they run;
contact you after an audit to ask how it went, and to offer 360Works consulting or custom work that addresses what your report found. To shape that offer, our staff may read your report's findings.

We do not sell your information, and we do not use it for advertising. We do not use your files, reports or audit logs to train AI models.

How ReportCard processes your files

Where the audit runs

Each run of an audit, the free read included, runs in its own container in our Amazon Web Services account. The container sits in a private network with no route to the internet. It can reach only the AWS services the audit needs, through private connections that admit only our own AWS account. Each run gets a storage key that opens its own audit's folder and nothing else.

The AI models

The paid audit uses AI models that run on Amazon Bedrock in our AWS account. Today those are Claude Opus 5.5 and Claude Sonnet 5.5, made by Anthropic. The models receive content from your files as the audit needs it. The free read uses no AI. Before ReportCard uses a model from another provider, we will update this policy.

Our requests to Bedrock start in AWS's US East (N. Virginia) Region. Bedrock may process each request in another AWS Region in the United States; AWS lists US East (N. Virginia), US East (Ohio) and US West (Oregon) for these requests. Those requests stay within the United States and on AWS's network.

AWS states that with Amazon Bedrock:

your content is not used to improve the base models and is not shared with any model providers;
AWS and the third-party model providers will not use any inputs to or outputs from Bedrock to train their models;
model providers, Anthropic included, have no access to Bedrock's logs or to customer prompts and completions.

Anthropic's terms for its models on Bedrock state that Anthropic may not train models on customer content.

Your FileMaker account, password and encryption key

These open your files, so they get the strictest handling of anything we hold:

The console encrypts them with an AWS key that it can only encrypt with. Only the step that prepares the free read can decrypt them.
That step hands them to the free read in an encrypted file. The free read deletes the file as soon as it reads it, keeps the values in memory, and keeps them out of its saved files and logs.
They never enter our workflow's history or the run's settings, and the AI models never see them. The paid audit works from the free read's results and never uses them.
We delete them when the free read ends, whether it succeeds or fails, or when the audit closes before a free read runs.

Create a Full Access account for the audit alone, and delete it once the audit is done.

Storage and transfer

Your files travel to us over encrypted connections and go straight from your browser into Amazon S3. S3 encrypts them at rest. The console keeps its database on the server: your browser never connects to the database. Download links for reports name a single report and expire after 5 minutes.

Who can see it

Your organization. Its members see its audits. Owners and admins also enter credentials, pay, discard audits, remove reports and remove finished audits from the organization's list.
360Works staff. Staff can see every audit, its detailed log including the AI sessions, the internal copy of its findings and its cost, to run, support and debug the service.
Our service providers. They handle data on our behalf, under contract, for the purposes below.

Provider	What it does for us
Amazon Web Services	Hosts the console; stores your files and reports (Amazon S3); runs your sign-in (Amazon Cognito); runs the audits and the AI models (Amazon Bedrock); holds encryption keys (AWS KMS) and logs
Supabase	Hosts our database, in AWS's US East (N. Virginia) Region
Stripe	Takes payments and issues refunds

Anthropic makes the AI models. Through Bedrock, Anthropic does not receive your content.

When we add a provider to keep customer records or send follow-up emails, we will list it here.

We may also share information when the law requires it, to protect our rights or our customers' safety, or as part of selling or merging our business, in which case this policy continues to apply to it.

How long we keep it

What	How long
FileMaker account, password and encryption key	Deleted when the free read ends, or when the audit closes before one runs
Uploaded files and the audit's working files	7 days after the audit ends: when it succeeds or fails, is refunded, or its free read fails. An audit that has not ended keeps them.
An unpaid audit's files	Until its quote expires 7 days after the free read; 2 days after you started it if you never asked for a quote; or within an hour of an owner or admin discarding it. Uploads you never finish expire after 2 days.
Reports and the internal copy of the findings	Until an owner or admin removes the reports, or an owner, admin or 360Works staff member removes an audit that has reports from the organization's list. We then delete both within an hour. A download link issued just before removal works until it expires, at most 5 minutes. A failed, refunded or stopped audit has no reports: we delete any partial internal copy with its working files, 7 days after the audit ends.
The audit's detailed log, including AI sessions	90 days. After that we keep only the record of which steps ran and when.
Run and workflow logs in AWS	30 days
Sign-in tokens	Until the sign-in ends: you sign out, or 8 hours pass
The audit's record: its name, file names and sizes, quote, payment, refund, progress and AI cost	As long as we need them for accounting, tax and legal records, then we delete them
Your account and organization records	While your account is open. When you ask us to close it, we delete it, except for records the law requires us to keep

Stripe keeps payment records under its own policy.

Your choices and rights

Owners and admins can remove an audit's reports from the report page at any time. Removal also deletes our staff's internal copy.
Owners and admins can discard an unpaid audit, which deletes its files.
Owners and admins can remove an audit from the organization's list once it has ended and any refund has gone through, or once they have discarded it. Removal also removes any reports it has, with our staff's internal copy of them, as removing the reports does. 360Works staff can also remove an audit from an organization's list, with the same effect. We keep the audit's record, and whatever else the table above still holds for it, for the periods the table gives, and our staff can still see them. To ask us to delete the record, write to support@360works.com.
You can stop our feedback and sales emails with the link in each one, or by writing to support@360works.com. We still email you about your audits, payments and account.
To see, correct or delete your personal information, or to close your account, write to support@360works.com. Your 360Works account also signs you in to other 360Works services, so we will tell you what closing it affects.

If you live in the EU, the UK or Switzerland

Data protection law there gives you rights over your personal information. We use it on these grounds:

to perform our contract with you: your account, your audits and your payments;
our legitimate interests: keeping the service secure, improving our price estimates, and contacting you after an audit for feedback or about our services. You can object to that contact at any time;
legal obligations, such as keeping tax and accounting records.

You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Write to support@360works.com and we will answer within one month. You can also complain to the data protection authority where you live.

We and our service providers store and process your information in the United States.

If you live in California or another US state with a privacy law

You can ask us what personal information we hold about you, and ask us to correct or delete it. We do not sell your personal information, we do not share it for targeted advertising, and we do not use it to make decisions that have legal or similar effects on you. We will not treat you differently for using these rights. Write to support@360works.com. We confirm who you are before we act, and we answer within 45 days.

When your files hold other people's data

If your FileMaker files hold personal data about other people, you decide what goes into the audit, and we process that data on your behalf to run it. You are responsible for having the right to share it with us. If you need a data processing agreement, write to support@360works.com.

Children

The console is for businesses. It is not meant for anyone under 18, and we do not knowingly collect information from them.

Changes to this policy

We may update this policy. We will post the new version here with a new effective date, and for a material change we will tell you by email or in the console before it applies.

Contact

Prometheus Systems Consulting, LLC
1875 Old Alabama Rd., Suite 755
Roswell, GA 30076, USA
Privacy questions: support@360works.com

Privacy Policy