Security
Security at every layer.
Encryption in transit, EU hosting, and explicit data residency. Built so your security team can sleep.
Trust overview
- GDPR-aligned
- DPA on request
- EU-hosted
- TLS 1.3
- Daily off-site backups
- No training on your data
Security pillars
Encryption
TLS 1.3 in transit, hashed credentials, encrypted off-site backups.
- TLS 1.3 in transit
- Passwords hashed (bcrypt)
- Daily backups to encrypted object storage
- Cloudflare edge protection
Identity & access
Email, Google, or GitHub sign-in with optional authenticator-app 2FA.
- Google OAuth
- GitHub OAuth
- Authenticator-app (TOTP) 2FA, optional
- Session expiry policy
Data residency
Application and database run on EU infrastructure (Hetzner, Germany). No third-region replication.
- EU-hosted (Hetzner, Germany)
- Single-region by default
- Daily database backups off-site
Sub-processors
Infrastructure and the model providers behind each feature. Full, current list available on request.
- Model providers engaged per feature
- Notification on additions
- Full list on request
Data flow
- 01
Client
Browser over TLS 1.3.
- 02
Edge
Cloudflare proxy + DDoS protection.
- 03
App
Authenticated, rate-limited requests.
- 04
Core
Application servers in EU (Hetzner, Germany).
- 05
Storage
Managed database + daily off-site backups.
Sub-processors
| Vendor | Purpose | Region | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (compute, storage) | EU (Germany) | View |
| Cloudflare, Inc. | Edge proxy, DNS, backup object storage | Global edge | View |
| Stripe, Inc. | Payment processing | US / EU | View |
| OpenAI, L.L.C. | Model inference (per feature) | US | View |
| Anthropic PBC | Model inference (per feature) | US | View |
| Google (Gemini API) | Model inference (per feature) | US / EU | View |
| ElevenLabs, Inc. | Voice generation (per feature) | US | View |
| Additional model providers | Per-feature inference (DeepSeek, xAI, Fal.ai, Perplexity, and others as used) | Varies | View |