Security
This page covers the hosted service at app.typefold.dev, run by Runecode OÜ in Estonia. If
you run Typefold on your own servers, your data stays there and your own measures apply.
Typefold has no SOC 2, ISO 27001 or HIPAA certification. For a security review, use the filled-in security questionnaire and the Data Processing Terms.
Where your data is
Section titled “Where your data is”| What | Where |
|---|---|
| The service and its database | netcup, Austria |
| Your files | Hetzner, Germany |
| Backups | Hetzner, Germany, at a different provider than the servers |
| Off-site copies of the backups and files | Backblaze, EU |
| A file you give an AI feature, only when you use one | Anthropic, United States |
| Connections to the service | Cloudflare passes them on to the servers and stores none of their content |
| This website | Cloudflare. It holds no customer data. |
Every provider that processes your data is in the subprocessor list. We tell you at least 30 days before adding or replacing one.
Encryption
Section titled “Encryption”- All connections to the service use HTTPS, and browsers are told to use nothing else.
- Signing certificates’ private keys, PDF passwords and webhook signing secrets are encrypted in the database with AES-256-GCM.
- Storage destination access keys you save are encrypted in the database the same way, used only to upload your workspace’s renders, never shown again, and deleted with the destination or the workspace.
- API keys are stored only as hashes; nobody can read a key back after it is created.
- Database backups are encrypted before they leave the server.
- Templates, render data and documents are not encrypted by the application. Access control protects them, as below.
Access
Section titled “Access”- Each workspace’s data is kept apart from every other workspace’s, checked on every request.
- Members have roles within a workspace, and each API key works in one workspace only.
- You sign in with a code sent to your email. Two-factor sign-in with an authenticator app is available to every account.
- Template scripts run in an isolated sandbox without network access, a new one for each render.
- Our servers accept SSH keys only, with password and root sign-in turned off, behind a firewall that allows only SSH and web traffic.
- Our administrators can open any workspace, with a workspace admin’s rights, to run and support the service. Two-factor sign-in is not yet required for their accounts. That is in progress.
Backups
Section titled “Backups”- Every change to the database is backed up within five minutes, and a full backup is taken every night and before every upgrade.
- The database can be restored to any moment of the last 24 days.
- Every week, the latest backup is restored automatically to check that it works.
- Every night, the backups and your files are copied to a second provider, where nobody can delete them for 25 days, us included.
- Files keep their earlier versions, so a deleted or overwritten file can be restored.
How long we keep data
Section titled “How long we keep data”- Renders: the input data and the document are deleted 30 days after the render was created.
- Deleted templates: their published versions are deleted 30 days later.
- Workspaces you shut down: their content is removed from the database at once, and their files shortly after.
- Server logs: 30 days.
- Backups and earlier file versions: 30 days at most. If a backup is ever restored, accounts and workspaces deleted after it was taken are deleted again.
The Privacy Policy has the full list.
Running the service
Section titled “Running the service”- Operating system security updates install automatically.
- Errors are tracked in Sentry’s EU region, without user details or request contents.
- Alerts reach us when the service, its disk or memory, or a backup fails.
- Service availability is shown on the status page, and paid plans have an uptime commitment.
Incidents and reports
Section titled “Incidents and reports”If a breach affects your data, we tell you without undue delay, and within 48 hours where we can, as the Data Processing Terms state.
To report a security problem, email [email protected].