Keeping your data safe. Always.

• Your workspace data is stored in Stockholm, Sweden

• We have full GDPR compliance with European data protection regulations

• Web hosting (Vercel), Google services (maps, reCAPTCHA, sign-in, web fonts), error reports (Sentry) and Nova web searches (DuckDuckGo) can process data outside the European Economic Area (EEA); our Data Processing Addendum lists each sub-processor and its location

Encryption everywhere

• All data encrypted at rest using industry-standard AES-256 encryption

• All data encrypted in transit using TLS 1.2 or higher

• Sensitive information and credentials managed through secure credential systems

Secure infrastructure

• We have multi-account architecture separating development, staging, and production environments

• Production data is completely isolated from development activities

• We use private network architecture with network-level security controls

Private Network Architecture

• Data runs in isolated networks with security controls

• Only authorised services can communicate with each other

Continuous vulnerability scanning

• We have a vulnerability scanning process of our infrastructure

• Immutable infrastructure prevents tampering once deployed

Access Control

• Fine-grained access policies enforce the principle of least privilege

• Each service has only the permissions it needs

Bot protection

• reCAPTCHA integration protects Starhive against automated attacks and abuse

Secure authentication

• We implement a multi-service authentication framework with dedicated credentials

• We use Google OAuth integration for secure user access

Environment separation

• We have strict separation between development, sandbox, and production environments

Automated security controls

• Security policies are enforced automatically through infrastructure-as-code

• This eliminates human error and ensures consistent protection

We have implemented:

• Automated daily backups with point-in-time recovery

• Multi-zone deployment ensuring high availability

• A comprehensive disaster recovery plan that is tested yearly

Security Standards

• SOC 2 Type II certified for security, availability, and confidentiality

• CIS benchmark compliance

• GDPR compliant data processing and privacy controls

Audit & Transparency

• Comprehensive audit logging of all system activities

• Regular internal and external security audits

• Transparent incident reporting and communication