Security
Security & EU hosting
The technical facts about where your data lives and how it's protected. We only state what's true today.
Where your data lives
- EU region. Hosted on Supabase in eu-west-1.
- European company. Built by Rivenholt AS — no US parent company.
How access is controlled
- Row-level security. The database enforces per-account access at the row level — not just in the app layer.
- Token-gated anonymous responses. Public response pages write only through narrow, token-checked database functions; they can't read or modify your other data.
- HTTPS everywhere. TLS with HSTS; strict content-security and framing headers.
In progress
Formal data-processing documentation (DPA, sub-processor list) is being prepared. This page will be updated when those documents are published — we won't claim them before they exist.