Hosting and region
The platform runs on managed cloud infrastructure (Vercel for the application, Neon for Postgres, Cloudflare R2 for file storage). Region selection — including EU processing where required — is confirmed per engagement.
Security · 7 commitments
Data handling, stated plainly.
Enterprise and investment buyers ask about data handling before price. Here are the answers, on the page.
Encryption
Data is encrypted in transit (TLS 1.2+) and at rest on every store. Uploaded files live in a private bucket; access is via short-lived signed URLs only.
Access control
Admin access is restricted to a named allowlist with magic-link authentication and role-based permissions. Every admin action that changes data is written to an audit log.
Subprocessors
Vercel (hosting), Neon (database), Cloudflare (file storage), Resend (transactional email), PostHog EU (analytics, consent-gated), Sentry (error monitoring), Cal.com (scheduling). The current list is available on request and updated before any addition.
Retention and deletion
Submitted applications are retained 36 months from last activity; uploaded files 12 months; abandoned drafts 90 days; planner sessions 180 days before anonymization. Verified-email erasure requests are honored across all stores and confirmed by email.
NDA and DPA
We sign mutual NDAs before discovery on request, and a DPA is available for any engagement processing personal data.
Incident contact
Security concerns reach the operator directly via the form below and are acknowledged within one business day.