What is in place today, what we inherit from our providers, and what is not yet in place. Nothing here implies a certification we do not hold.
SiteActa is built and operated by a Swiss company. Project content at rest (the database, user accounts and every uploaded file) is stored with Supabase on AWS in eu-central-1 (Frankfurt, Germany), and AI processing of that content is pinned in code to Google Vertex AI in europe-west4 (Netherlands). Two parts of the service are not EU-restricted: the application runtime and TLS termination run on Cloudflare's global edge, where the nearest point of presence serves the request, and inbound email is received through SendGrid, whose processing region is not restricted to the EU. Outbound notification email is sent through Resend via the Lovable connector gateway, and the timestamping authority receives only a SHA-256 hash, never your content. The full provider list is published in the subprocessor register below.
Sign-in is email and password or Google. Email verification is required and anonymous accounts are disabled. Access to a project is by invitation only, granted by a project administrator. Roles are held in dedicated tables read by database functions, never on a user or profile record, and an external viewer sees only the topics explicitly granted to them. Multi-factor authentication is not yet enabled for user accounts, and SAML single sign-on is not yet offered.
HTTPS is enforced on every response, with HSTS set for one year including subdomains; the domain is not on the browser preload list. Database, storage and AI calls all run over TLS. Encryption at rest for the database and object storage is provided by the underlying platform, Supabase on AWS, and is inherited from that provider rather than independently verified by us. There is no application-level field or column encryption: content is stored in plaintext columns, and hashing protects its integrity, not its confidentiality.
Postgres database, authentication and object storage run on Supabase on AWS in eu-central-1. Application runtime and TLS termination run on Cloudflare. AI inference and embeddings run on Google Vertex AI, pinned in code to europe-west4. Inbound project email is received through SendGrid and outbound notification email is sent through Resend. There is one private storage bucket, with a per-object size ceiling and a file-type allowlist, and every object access is decided per path by a database function.
Access control is enforced in the database by row-level security: every table in the application schema has it enabled, with policies that never use an unconditional rule, so a stolen client key alone grants nothing. A small, enumerated set of HTTP endpoints is reachable without a session: the inbound-email webhook, which verifies an ECDSA signature from the mail provider, the scheduled maintenance hooks, which require a shared secret, the Content-Security-Policy violation report endpoint, and the service discovery routes. Inbound mail is rate limited before it is parsed or stored. A Content-Security-Policy is currently served in report-only mode: violations are recorded but nothing is blocked, while the policy is calibrated against real traffic before it is enforced. Until enforcement, cross-site-scripting mitigation rests on server-side sanitisation and framework escaping.
Security-relevant actions are written to append-only tables whose immutability is enforced by database triggers rather than by application code: platform-role changes, ingest-token rotation, share-link and invitation access attempts with IP address and outcome, per-phase inbound email processing, provenance downgrades and project-record sign-off revocations. Sign-in, sign-out and failed authentication events are held by the authentication platform and are not yet mirrored into an application-readable audit table.
Backups are provided by the underlying database platform. We have not independently verified whether point-in-time recovery is enabled, nor the backup frequency or the retention period. Retention is set by that platform and is not configurable by us, which also means that deleted data persists in backups until it ages out. We have not defined a recovery time or recovery point objective, and no restore exercise has been carried out and documented.
SiteActa is operated by a single-operator company: there is no on-call rotation and no documented incident-response runbook. A security contact is published at /.well-known/security.txt and reports are acknowledged directly by the founder. Customers affected by an incident would be notified by email.
DSWaldron GmbH is a Swiss company subject to the revised Swiss FADP and, for customers in the EU, acts as processor for project content under the GDPR. Project content at rest is stored in the EU and AI processing of that content is pinned to the EU; edge delivery and email transport use providers with global infrastructure, each named in the register below. Customer content is not sold and is not used to train AI models. A data-processing agreement is not yet published as a standard document; we will enter one on request.
None has been obtained yet. There is no SOC 2 report, no ISO 27001 certification, no third-party penetration test and no independent audit of the access-control policy set. Assurance today is internal: a documented security posture assessment derived from the running system, dependency vulnerability checks run manually and on demand rather than as a configured automated process, database policy linting and an automated test suite focused on security-sensitive paths. We would rather state that plainly than imply a certification we do not hold.
A detailed security document, derived from the running system, is available on request under NDA.
Evidence integrity (hashing, independent timestamping, versioning and completeness reporting) is documented separately: Evidence integrity
Every third-party provider that touches customer data when you use SiteActa. Providers referenced in code but not in use (including payment processing) are not listed, because they process nothing today. Rows marked browser-side are requested by the visitor's own browser, which exposes the visitor's IP address to that provider.
| Provider | Service provided | Data it touches | Processing location | Restriction |
|---|---|---|---|---|
| Supabase (AWS) | Database, authentication, object storage | All project content at rest: records, documents, photographs, emails, account data | eu-central-1 (Frankfurt, DE) | EU-restricted |
| Google Vertex AI | AI inference and text embeddings | Project text and document content submitted for analysis | europe-west4 (NL), pinned in code | EU-restricted |
| Cloudflare | Application runtime, edge delivery, TLS termination | Requests and responses in transit, including content being viewed or uploaded | Global edge, nearest point of presence | Global |
| SendGrid (Twilio) | Inbound email received at project addresses | Full inbound emails and their attachments | Not restricted to the EU | Global |
| Resend | Outbound transactional email (invitations, notifications, resets) | Recipient address, name, and notification content | Sent via the Lovable connector gateway | Global |
| Lovable | Platform management, deployment, connector gateway | Application configuration and deployment; outbound mail brokering | Global | Global |
| DigiCert | RFC 3161 trusted timestamping | A SHA-256 hash only, never document or record content | Global TSA endpoint | Global |
| Cloudflare DNS-over-HTTPS | DKIM public-key lookup during inbound email verification | A DNS query for a public selector record derived from an inbound message | Global resolver endpoint | Global, server-side |
| Google Fonts | Web typography, served to the visitor's browser | Visitor IP address | Global | Global, browser-side (visitor IP) |
| Google OAuth | Optional sign-in with a Google account | Authentication exchange initiated by the user | Global | Global, browser-side (visitor IP) |
| Open-Meteo | Weather and geocoding for site diary records | Project location coordinates | EU | EU, server-side |
| RainViewer | Weather radar map tiles | Map tile requests, visitor IP address | Global | Global, browser-side (visitor IP) |
| OpenStreetMap | Base map tiles | Map tile requests, visitor IP address | Global | Global, browser-side (visitor IP) |
| unpkg | Map marker assets delivered to the browser | Visitor IP address | Global | Global, browser-side (visitor IP) |
Customers will be notified before a new subprocessor is engaged or an existing one changes materially.