1. Infrastructure
Where Amberbook runs and how traffic and data are protected.
EU-only hosting
A dedicated server at Hetzner Online GmbH in Falkenstein, Germany. The application, both databases and all backups stay inside the EEA.
TLS with HSTS
All public endpoints serve TLS 1.2 and 1.3 with modern ciphers. Plain HTTP redirects to HTTPS and HSTS is enabled with preload, so browsers never downgrade.
Browser hardening headers
Content-Security-Policy, X-Frame-Options DENY and related headers are set on every response, so the application cannot be framed or fed third-party scripts.
Hardened host
SSH is key-only with root login disabled, the firewall exposes only SSH, HTTP and HTTPS, brute-force attempts are banned automatically, and security updates install unattended.
Two planes, two networks
Customer-facing services run on their own container networks and cannot reach the data-collection engine. The customer database receives only published columns; dates of birth and personal identifiers never cross.
Secrets never in code
Application secrets live in environment files on the host, outside the repository. The production signing secret is validated at startup - a weak or default value stops the service from booting.
2. Authentication and access control
How accounts are secured and what each user can reach.
bcrypt password hashing
Passwords are hashed with bcrypt before storage. Plaintext passwords are never stored, logged or sent by email.
Short-lived sessions
The web session is an HttpOnly, Secure, SameSite=Lax cookie that expires after 3 hours. State-changing requests additionally carry a single-use CSRF token.
API access
API clients use a 3-hour access token with a 7-day refresh token, or a long-lived API key that can be revoked from the Account page at any time.
Sign in with Google
Google OAuth sign-in is supported. Microsoft Entra, Okta and generic SAML/OIDC are on the roadmap below.
Per-account rate limits
Every account carries its own per-minute and per-day request budget, enforced on each API call. Defaults are 200 requests per minute and 10,000 per day; paid engagements set their own values.
Roles
Four roles: administrator, organisation owner, organisation member and API-only. Administrative endpoints are gated on every request, not by a token claim alone.
Audit log
Sensitive actions - sign-in, export download, watchlist changes, privacy requests and administrative operations - are written to an audit log with actor, timestamp, IP address and affected record.
Least privilege. Exactly one person has production access: the founder. No contractors and no shared accounts.
3. Data handling and sub-processors
We process the minimum data needed to run the service. We do not sell data to third parties, do not run advertising and do not use tracking or analytics cookies. Amberbook has no Google Analytics, no Meta pixel and no advertising SDKs - only the session and preference items listed in the Cookie Policy.
| Sub-processor | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application, databases, object storage and backups | Germany (EU) |
| Postmark (ActiveCampaign, LLC) | Transactional email: invitations, password resets, alerts | USA - EU-US Data Privacy Framework |
| Google LLC | Sign in with Google, only for accounts that choose it | USA - EU-US Data Privacy Framework |
| Ollama, Inc. | Hosted language models for enriching public business records; never receives customer data | USA - Standard Contractual Clauses |
Cloudflare, Inc. provides DNS for our domain only; application traffic goes directly to our server in Germany. Changes to this list are announced by email to customers at least 14 days before they take effect.
4. Backup and retention
How long we keep data, where copies live and when they are deleted.
- Daily database backups. Both databases are dumped every day at 02:00 UTC and the last 30 days are kept on the host.
- Off-host copies in EU object storage. Documents and exports are mirrored daily, and database dumps are copied, to Hetzner Object Storage in Falkenstein - a separate system from the server itself.
- Restores, not just backups. A backup counts only once it has been restored. The production databases themselves were brought up from these dumps on 2026-09-23, and a scripted restore drill is kept for repeat checks.
- Short-lived download links. Links to Excel, CSV and PDF exports expire five minutes after they are issued. The files stay with your account and can be re-issued.
- Account deletion. Deleting your account starts a 30-day grace period, after which the account is anonymised. Backups rotate the data out within a further 30 days.
5. Incident response
What happens if something goes wrong, and how fast.
Containment first
A suspected incident is contained before it is analysed: affected credentials are rotated, sessions are revoked and the entry point is closed. Evidence is preserved for the review that follows.
GDPR Article 33: 72-hour notification
Where an incident is a personal-data breach under GDPR Art. 4(12), we notify the Slovak supervisory authority (Úrad na ochranu osobných údajov) within 72 hours of becoming aware of it.
Customer notification (Art. 34)
Where the incident is likely to result in a high risk to your rights and freedoms, we notify affected users without undue delay.
Coordinated disclosure
Researchers, customers and members of the public can report suspected vulnerabilities to support@amberbook.eu. There is no paid bug bounty, but we acknowledge every report, keep reporters informed and credit them on request once a fix ships.
6. Roadmap
Transparent roadmaps over marketing claims. Amberbook does not currently hold SOC 2, ISO 27001 or Cyber Essentials certifications. The items below are our plan, not present-day claims.
Automated off-host database copies
In progressDatabase dumps are copied to object storage today; the copy is being made part of the nightly backup job with its own alerting.
Point-in-time recovery
PlannedContinuous archiving of the database write-ahead log, so a restore can land on any minute rather than the last nightly dump.
Encryption at rest on the host
PlannedFull-disk encryption of the server volumes. Requires a maintenance window and a reinstall; scheduled with the next hardware change.
External penetration test
PlannedCommissioned ahead of the first multi-seat engagement. Results and remediation status available under NDA on request.
SOC 2 Type 1
PlannedWhen customer demand justifies the audit cost. We already run the practices a Type 1 would attest to; we have not paid an auditor yet.
ISO 27001
ConsideringUnder consideration if EU enterprise procurement requires it. Tell us if you need an ISO timeline as a condition of purchase.
Argon2id password hashing
Plannedbcrypt today, Argon2id with transparent re-hash on next sign-in later. bcrypt remains considered safe; this is a defence-in-depth upgrade.
Per-dataset and per-country scopes
PlannedAPI keys scoped to specific markets or datasets, so a key shared with a vendor can read one country only. Today access is binary per account.
Enterprise single sign-on
PlannedMicrosoft Entra, Okta and generic SAML/OIDC for larger engagements.
This section is updated as items move from planned to in progress to complete. We will not quietly add certification claims here; any certificate we earn will be named, dated and linked.
7. Contact
Security issues
Put “Security” in the subject line. Acknowledgement within 3 business days; critical issues such as active exploitation or confirmed data exposure are triaged the same day.
Privacy enquiries
Put “Privacy” in the subject line. GDPR rights requests and all other privacy questions. The Privacy Policy lists your rights and the request form is the fastest route.
PGP-encrypted email is on the roadmap and will be published on this page when available.