What we do, and what we don't.
Boring technology, no telemetry, EU data residency by default. The full technical measure list is in our DPA.
Defaults.
EU hosting
Cloudflare edge (EU). App runtimes on OVH VPS in Frankfurt or Strasbourg. PostgreSQL 16 with TLS in transit. Backups encrypted at rest with restic.
Encryption
HTTPS enforced (HSTS preload). TLS 1.3 minimum. Passwords hashed with Argon2id. Database column-level encryption for the highest-sensitivity fields (per-system C2PA manifest hashes, payment secrets).
No telemetry
We do not run Mixpanel, Amplitude, Segment, or any third-party analytics on our products. We do not sell customer data. We do not profile end users for advertising.
Secret management
3-tier credential strategy (Rule 154): MCP-first for live ops, long-lived scoped tokens for runtime, short-lived full-mutation tokens only for admin tasks. No secrets in code. No secrets in git history. No SDK keys on client devices.
Access control
Better Auth admin plugin. Role-based (admin / user). Per-organization memberships. Cloudflare Access in front of internal admin tools. MFA required for all admin accounts.
Backups
Daily restic backups of every product database. 30-day retention. Backups stored encrypted on Koofr (EU) with immutable retention. Monthly restore drill.
When something goes wrong.
Breach notification
We notify affected customers within 72 hours of becoming aware of a personal-data breach, per GDPR Art. 33. Notification includes: nature of the breach, categories and approximate number of data subjects, likely consequences, and measures taken.
Detection
Uptime Kuma for service availability. Self-hosted Beszel for resource saturation. Cloudflare DDoS protection. Better Auth audit trail for authentication anomalies.
Response
On-call engineer (Aleks NestLab, founder) is the first responder. Decision-tree runbooks for: 5xx spike, suspicious auth, leaked credentials, data exposure, dependency CVE. Rollback via Dokploy image re-tag (per nest-rollback-executor skill).
Post-mortem
Blameless post-mortem within 5 business days of any sev-1 or sev-2 incident. Published internally; summary shared with affected customers on request.
Reporting a vulnerability.
We do not have a paid bug bounty program. We do commit to respond within 5 business days and credit researchers in our post-mortems.