Security and sub-processors

Technical and organisational measures

Connections are protected with TLS. Passwords are stored one-way salted hashed; only a SHA-256 digest of API keys and OAuth tokens is kept. Optional TOTP second factor. Sandbox and live data are separate. Every critical action is written to the audit log. Database access uses least privilege; the staff panel is a separate application. Webhook calls are made with a hardened client that blocks access to private networks.

Sub-processors

Hosting and database: the server provider on which the Service runs (named here with its country once live). E-mail and SMS: the provider chosen. WhatsApp: Meta Platforms (WhatsApp Business Cloud API), only if you use the assistant. Machine translation: DeepL SE, only when you request a translation and only the text being translated is sent. Map tiles: OpenStreetMap Foundation. Payments: the payment institution chosen for plan fees. This page is updated when the list changes and material changes are announced in advance.

Reporting a vulnerability

If you found a security vulnerability please write to our contact address with details. We do not take legal action against good-faith researchers; do not access user data, do not disrupt the Service and do not disclose the issue until it is fixed. We reply within 3 business days.