Protection you can rely on.
| Standard | Our status | Notes |
|---|---|---|
| GDPR | Compliant | See policy |
| CCPA | Compliant | See policy |
| HIPAA | Out of scope | — |
| PCI DSS | Outsourced (Paddle, WayForPay) | — |
// No third-party certification audit has been carried out. We list only controls that are in place today.
Runs on Railway with managed PostgreSQL. Uploads and generated PDFs live in Cloudflare R2 over the S3 API. Traffic is TLS 1.3; disks and object storage are encrypted at rest by the provider.
- 01 Railway · hosting
- 02 Cloudflare R2 · object storage
- 03 TLS 1.3 in transit
- 04 Encrypted at rest
Password sign-in through Devise, plus Google sign-in. Sessions are JWTs with rotating refresh tokens. Every admin action is written to an audit log, and every model carries a full PaperTrail version history.
- 01 Devise · password sign-in
- 02 Google sign-in
- 03 JWT · rotating refresh
- 04 Admin audit log
Your projects, boundaries and bills of materials stay in your own account, enforced per request by authorization policies. Export at any time as JSON or PDF. A deleted project is held for 90 days, then removed permanently by a scheduled job.
- 01 Per-account authorization
- 02 Export · JSON / PDF
- 03 90-day deletion grace
- 04 Scheduled hard delete
Every pull request runs Brakeman for Ruby static analysis, bundler-audit for gem advisories and npm audit for JavaScript ones; a failure blocks the merge. Requests are rate-limited per endpoint and capped in size, and security headers are set on every response.
- 01 Brakeman · every PR
- 02 bundler-audit + npm audit
- 03 Per-endpoint rate limits
- 04 CSP · HSTS · frame protection
Every subprocessor is named in the DPA, and changes get a 30-day notice. Key vendors: Railway (hosting), Cloudflare (DNS and R2 storage), Paddle and WayForPay (payments), Resend (email), AppSignal (monitoring).
- 01 Railway · hosting
- 02 Paddle / WayForPay · payments
- 03 Resend · email
- 04 AppSignal · monitoring
Errors and performance are tracked in AppSignal. On a personal-data breach we notify affected users without undue delay and the supervisory authority within 72 hours, as GDPR requires. Service health is published on the status page.
- 01 AppSignal · error tracking
- 02 72h regulator notice
- 03 Status page · public
Security questions?
Report a vulnerability to security@smartpluvia.studio. For anything else, use support.