Encryption
Traffic to and within the Service is encrypted in transit using TLS. Where our infrastructure providers support it, data is also encrypted at rest.
Access control
Role-based access control, single sign-on (GitHub and Google), optional two-factor authentication and scoped API tokens let you grant least-privilege access. Sensitive owner actions may require you to re-authenticate.
Internal access
Internal access to customer environments is limited to what is necessary to operate and support the Service, and access to production systems is logged.
Infrastructure
The platform uses established third-party infrastructure providers, including Contabo, UpCloud, Cloudflare, Amazon Web Services (AWS) and DigitalOcean. Available providers and processing locations depend on the resource and selected region. We apply security updates to systems we manage and isolate app tenants at the network and orchestration layers.
Backups
Managed-database backup behavior is provided by the selected infrastructure provider. The Unbroker API does not currently expose database backup or restore controls. App-service persistent volumes have separate configurable backup destinations and schedules. You remain responsible for keeping independent copies of critical data.
Compliance
We do not currently hold formal third-party certifications such as SOC 2 or ISO 27001. We honor data-subject requests as described in our Privacy Policy.
Responsible disclosure
Found a vulnerability? Email support@unbroker.dev. We aim to acknowledge reports promptly and will work with you on a fix. Please give us reasonable time to remediate before any public disclosure.