DraftThis page has not been reviewed by counsel and is not published. It will not go live until the marked fields are filled. Missing: server provider, merchant of record, DPA template and security contact.
Security and sub-processors
How the infrastructure is protected, what protects your account and who your data passes through.
01Infrastructure
- The server’s web ports are closed to the internet. Traffic arrives over an encrypted connection that Cloudflare Tunnel opens outward from the server.
- The databases are not reachable from the internet, only from inside the server.
02Account security
- Passwords are hashed with argon2id; the password itself is never stored.
- Session tokens are stored as hashes. The cookie cannot be read by JavaScript (HttpOnly), travels over HTTPS only (Secure) and is not attached to requests from other sites (SameSite=Lax).
- Failed sign-ins are limited: 6 per email address and 50 per IP address in 15 minutes.
- Changing or resetting your password closes all your sessions.
- Email-verification and password-reset links are single-use and expire; asking for a new one cancels the old one.
- You can see your open sessions on the account page and close them all with one button.
03Access to data
- Contact details of records you have not opened are masked on the server and never sent to your browser.
- Every export is logged: who, when, with which filters and columns, and how many rows.
04Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Network, content delivery and the encrypted tunnel to our server | US-based, global network |
| Resend | Account and watch emails | Sending region Tokyo (AWS ap-northeast-1) |
| to be filledserver provider | Application and databases | to be filleddata-centre country |
| to be filledmerchant of record | Payments and invoicing | to be filledonce selected |
05Documents and certifications
We do not hold SOC 2 or ISO 27001 certification.
- Data processing agreement (DPA): to be filledtemplate — to be drafted by counsel
- Personal data: privacy notice; browser storage: cookies.
06Reporting a vulnerability
If you have found a security issue, write to us: to be filledsecurity contact address
Machine-readable contact details are in security.txt.