How your data is handled

Nothing of yours is exposed to the internet

Services run on our own server and none of them opens a port to the outside. That is not extra caution: when a container publishes a port, Docker inserts its firewall rules ahead of the system’s, so the port is reachable from the internet even while the firewall denies it. It is a silent and common failure.

• No service publishes a port. It is checked on every review rather than assumed.
• Traffic arrives through an encrypted Cloudflare tunnel opened from the server outwards: there is no inbound door to force.
• Databases live on a separate internal network. The tunnel cannot see them, not even by name.
• SSH by key only — no passwords, no root, and a cap on attempts.

Every console demands identity, and verifies it properly

Reaching any panel means passing Cloudflare Access first. And the application does not take Cloudflare’s word for who you are: it verifies the cryptographic signature of that claim against the provider’s public keys.

• The header carrying the user’s email is never used as proof. It is plain text, and any process on the internal network could set it and walk in as someone else. Only the signature proves anything.
• If authentication is not configured, the application serves nothing and says it is closed. It fails closed on purpose: a console left open by a bad deploy is worse than one that is down, because nobody notices.
• Permissions are enforced at each address, not by hiding a menu link. Someone who should not see costs gets a 403 even typing the address directly.
• Logging out ends the session at the edge, not just the local cookie.

Backups exist, are encrypted, and have been proven by restoring them

A backup nobody has ever restored is an assumption. Ours was restored for real: the local copy was deleted, the offsite one pulled down, decrypted and loaded into a clean database to confirm the data was complete.

• Daily automatic backup, encrypted with AES-256 before it leaves the server.
• Seven copies on the server and thirty off it, with a different provider.
• If a backup fails, it raises an alarm. And if it stops running at all, it also raises one — which is the failure that actually goes unnoticed.
• Restores are rehearsed against a throwaway, network-isolated database, touching nothing in production.

Who came in and what they looked at is recorded

In systems holding personal data, every access is logged with the user, what they viewed, what they changed, and the real address they did it from.

• The visitor’s real IP is stored, not the server’s own — the usual mistake behind a proxy, and one that makes the whole log useless.
• The access log is visible only to administrators.
• Services that write to the database connect with minimum permissions: the automated assistant can record what happens and cannot read back a single conversation it wrote.

Your data and ours do not mix

Each client’s data lives in its own database, in its own container. It is not a folder-level separation inside a shared system.

• The day you want to take your database, it is handed over whole with nothing to filter out, because there is nothing of anyone else inside it.
• What we record about our own operation sits in a separate system and is not delivered with any project.

Consent with evidence, not with a checkbox

Colombia’s Law 1581 of 2012 requires express authorisation to process personal data. A ticked box, on its own, proves nothing.

• For every form submitted we store the authorisation with its exact timestamp, its origin and the language it was shown in.
• The website does not record anonymous visitors on any server. What is known about how someone arrived lives in their own browser and only travels if that person chooses to write to us.
• There are no third-party tracking cookies for personalised advertising.

If something breaks, we know before you do

Every five minutes a watchdog checks that services respond, and alerts through two separate channels if anything fails.

• The check requires each service to answer with something only it could answer. A correct status code is not enough: protected systems answer correctly from Cloudflare’s network even with the server switched off, and a watchdog that trusts that reports green through a total outage.
• It also alerts if the disk fills up or a backup stops running.
• The watchdog is tested by breaking things on purpose, one failure at a time, to confirm it really does alert.

It can be checked

None of the above is a brochure promise: each point maps to a concrete decision in the system and can be shown working. If you are deciding who to hand your company’s data to, ask to see this — from us or from anyone else.