A page for whoever reviews this, not whoever is selling it.
This is the technical half of a security review: where data lives, who can reach it, how it's encrypted, and what's logged. It says plainly what we don't provide, too. Compliance is a programme your organization runs; this is the infrastructure half of it.
One region. Nothing leaves it.
Hosting provider and region are chosen per client at deployment: Hetzner, DigitalOcean, or AWS, with DigitalOcean the default for US clients. Development and sandbox environments run on Netcup GmbH.
Whichever provider is chosen, the platform runs in a single region, and application data, backups, and logs stay inside it; nothing is replicated or processed outside it as a matter of course.
Backups are encrypted and retained on a rolling schedule. Restoring from one is a deliberate, logged action, not an automatic failover to a copy you can't account for.
Who can reach production, and how we know.
Our engineering team is small and distributed. Production access is individually credentialed, not shared, and scoped to what a given engineer's work requires rather than granted wholesale.
Every administrative action against production, a role change, a manual data touch, a deploy, is attributable to the person who made it and logged as such. We hold our own infrastructure to the same access-control and audit-trail standard the platform enforces for your tenants.
We say the team is distributed because a reviewer will find that out either way, and stating it here is more useful than a reviewer discovering it later and wondering what else wasn't said.
At rest, in transit, and still searchable.
Encrypting a column and still being able to query it are usually in tension; the blind index is what resolves that without falling back to storing the value in the clear.
Append-only in the schema, not just in policy.
The audit log rejects UPDATE and DELETE
at the database level. That isn't application logic that could be
skipped by a new code path; it's a constraint the schema itself
enforces, so a compromised application account still can't rewrite
history.
It records role changes, data erasures, and refused attempts to reach another tenant's data, each entry attributable to a user, an application, or an administrative action, in a form a human can read without a translation layer.
Enforced three times, not once.
Authorization in the service, row-level security in the database, and schema constraints that make the wrong tenant assignment unrepresentable. The full breakdown, with the numbers behind it, is on the platform page.
None of the three layers alone is the security boundary. A bug that defeats one is still caught by the next. See how the boundary holds →
Where to send it, and what to expect.
Report a suspected vulnerability or an active incident to [email protected]. We reply within one business day, sooner for anything that looks active or urgent.
A machine-readable version of this contact path is published at
/.well-known/security.txt.
Who else touches data, and for what.
Hetzner, DigitalOcean, or AWS (production), Netcup GmbH (sandbox/dev)
Infrastructure hosting: compute, database, and backups, within a single region. Production runs on Hetzner, DigitalOcean, or AWS, chosen per client, DigitalOcean by default for US clients. Sandbox and development run on Netcup GmbH.
EmailJS
Delivers messages submitted through this site's contact forms. Sees the name, email, and message you enter; nothing else.
Google Calendar
Powers the scheduling widget on the platform page's booking section. Google, not Latch Vector, holds the calendar data for a booked slot.
Plausible Analytics
Cookie-free traffic analytics for this marketing site. Does not run inside the platform product itself.
The parts that stay yours.
What buying this doesn't give you: a Business Associate Agreement with your hosting provider, a documented risk assessment and a designated security officer, an incident-response plan, a third-party penetration test, and deciding who gets administrative access in the first place. Compliance is a programme, not a feature: this page is the technical half an auditor can be shown, not the paperwork half.
Send them directly.
Within one business day