A plain-language summary of the infrastructure, access controls, data handling, and incident-response practices that keep Amberbook safe. Kept in sync with the code and infrastructure that actually runs the service.
Section 1
Where Amberbook runs and how traffic and data are encrypted.
Hetzner Online GmbH in Germany. Single-region EU deployment - no traffic is processed in the US or outside the EEA.
All public endpoints serve TLS 1.3 only. Older TLS versions are disabled, plain HTTP redirects to HTTPS, and HSTS is enabled.
All host disks use AES-256 full-disk encryption. Database volumes, object storage, and backup volumes are encrypted before any Amberbook data is written.
Cloudflare handles DNS and edge TLS termination with EU data-localisation routing that keeps EU visitor traffic inside the EU network.
Application secrets live in environment variables on the host. The production JWT secret is validated at startup - weak or default values cause the service to refuse to boot.
Section 2
How accounts are secured and what each user can reach.
Passwords are hashed with bcrypt (via passlib) before storage. Plaintext passwords are never stored, logged, or sent in emails. Argon2id migration is on the security roadmap below.
15-minute access tokens plus rotating refresh tokens. Refresh tokens are one-time-use - reusing one invalidates the whole token family in Redis and forces a new login.
Access and refresh JWTs carry distinct type claims and are rejected outside their context - a refresh token cannot be used to call an API endpoint and vice versa.
Google OAuth sign-in is already supported. Microsoft Entra, Okta and generic SAML/OIDC are on the roadmap for higher contract sizes.
Each account carries its own per-minute and per-day request budget on the user record. Limits are enforced by Redis-backed middleware on every API call; quota and tier are not coarse plan flags but bespoke numeric values configurable per customer.
Two roles today - admin and standard user. Admin endpoints are gated by middleware on every request, not by a JWT scope alone. Future scope-gating per dataset/country is on the security roadmap below.
Sensitive actions (login, export download, watchlist write, GDPR request, admin operations) are written to an audit_log table with actor, timestamp, IP and affected record. 90-day retention.
Least privilege. There is exactly one person with production access, the founder. No contractors, no shared accounts, no shell access from personal devices without WireGuard + hardware key.
Section 3
Who processes data on our behalf and what we explicitly do not do.
We process the minimum data needed to run the service. We do not sell data to third parties, do not run advertising, and do not use tracking cookies. Amberbook has no Google Analytics, no Meta pixel, no advertising SDKs - only strictly necessary session and CSRF cookies.
| Sub-processor | Role | Location | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (compute, block storage, backups) | Germany (EU) | Hetzner DPA - signed, on file |
| Cloudflare, Inc. | DNS, edge TLS, DDoS protection | US HQ with EU edge routing | Cloudflare DPA - public / accepted |
| Postmark (ActiveCampaign LLC) | Transactional email (password reset, alerts) | USA, covered by EU-US Data Privacy Framework | Postmark DPA - signed, on file |
| Sentry (Functional Software, Inc.) | Error tracking | EU region explicitly selected | Sentry DPA - signed, on file |
| Better Stack (BetterStack s.r.o.) | Uptime monitoring, on-call paging | Slovakia (EU) | Standard ToS + DPA - on file |
Hetzner Online GmbH
Cloudflare, Inc.
Postmark (ActiveCampaign LLC)
Sentry (Functional Software, Inc.)
Better Stack (BetterStack s.r.o.)
Changes to this list are announced via email to customers with at least 14 days' notice before they take effect.
Section 4
How long we keep data, and when it is automatically deleted.
Daily encrypted backups
Both databases (ops and client) and object storage backed up every 24 hours. AES-256 encrypted before leaving the host, stored in a separate Hetzner region.
7 days operational retention
Rolling 7-day backup window. Older backups are automatically deleted by lifecycle policy.
90 days audit log retention
Audit records are auto-purged after 90 days. Security-incident exports may be retained longer if required to complete an investigation.
24-hour export lifecycle
Excel / CSV / PDF exports you generate are deleted from our servers after 24 hours. You keep the copy you downloaded.
Automatic enforcement
All retention is enforced by an automatic lifecycle policy, not a manual process.
Section 5
What happens if something goes wrong - and how fast.
The playbook for responding to a suspected or confirmed security incident is docs/runbooks/breach_response.md. It covers detection, containment, evidence collection, assessment, notification, and post-incident review.
Where an incident constitutes a personal-data breach under GDPR Art. 4(12), we notify the Slovak supervisory authority (Úrad na ochranu osobných údajov) within 72 hours of becoming aware, as required by Art. 33.
Where the incident is likely to result in a high risk to your rights and freedoms, we notify affected users without undue delay in accordance with Art. 34.
Security researchers, customers, and members of the public can report suspected vulnerabilities to security@amberbook.eu. We do not currently run a paid bug bounty, but we acknowledge reports, keep reporters informed, and credit them on request once a fix ships.
Section 6
Transparent about what we have - and what we do not have yet.
We believe in transparent roadmaps over marketing claims. Amberbook does not currently hold SOC 2, ISO 27001, or Cyber Essentials certifications. The items below are our honest plan, not present-day claims.
H2 2026 - when customer demand (and revenue) justifies the audit cost and ongoing control overhead. We already run the practices a Type 1 would attest to; we haven't paid an auditor yet.
6-12 months after the Type 1 report, pending customer need.
Under consideration for year 2+ if EU enterprise procurement requires it. Tell us if you need an ISO timeline as a condition of purchase.
Commissioned ahead of the first multi-seat engagement. Results and remediation status available under NDA on request.
In place for the current sole admin. Enforced by policy once there is a second admin on the team.
Bcrypt today, Argon2id (OWASP-recommended parameters, with transparent re-hash on next login) on the security roadmap. Bcrypt remains broadly considered safe for password storage; this is a defence-in-depth upgrade.
API tokens scoped to specific countries or datasets at the database layer (e.g. an SK-only key cannot read PL companies). Today access is binary - your account either reaches the platform or it does not. Scoped tokens are useful for procurement teams that want to share a key with a vendor for one country only.
This section is updated as items move from “planned” to “in progress” to “complete.” We will not quietly add certification claims here - any certificate we earn will be named, dated, and linked.
Section 7
Where to reach us with a security issue or a privacy question.
Security issues
security@amberbook.eu
Acknowledgement within 3 business days. Critical issues (active exploitation, confirmed data exposure) triaged the same day.
Report a vulnerability
Privacy enquiries
privacy@amberbook.eu
GDPR rights requests and all other privacy questions. See the Privacy Policy for the full list of your rights and how to exercise them.
Exercise GDPR rights
PGP / encrypted email support is on the roadmap and will be published on this page when available.