Security & Trust

Infrastructure

Asphalyn runs on the following infrastructure providers. All are established third-party vendors with their own security programs.

• Application hosting: Vercel Inc. (frontend and backend). Serverless functions run in the EU Central region (Frankfurt, Germany — fra1).
• Database: Aiven Ltd, running on DigitalOcean infrastructure in Amsterdam, Netherlands (ams3). Database backup storage is located in Bangalore, India (do-blr1).
• Attachment storage: Backblaze, Inc. (Backblaze B2) in the US East region (Reston, Virginia — us-east-005).
• Billing: Paddle.com Market Ltd (merchant of record, United Kingdom). Asphalyn does not store payment card data.
• Authentication: Google LLC (OAuth 2.0). Asphalyn does not store passwords.
• Transactional email: Hostinger International Ltd. (workspace invitation emails only).

Encryption

• In transit: All traffic between your browser and Asphalyn is encrypted using TLS 1.2 or higher.
• At rest: Data at rest is encrypted by our infrastructure providers (Aiven and Backblaze B2) using AES-256 or equivalent.
• No end-to-end encryption: Asphalyn does not use end-to-end encryption. Platform operators have technical access to customer data. This is described in detail in our Privacy Policy.

Authentication

• Google OAuth 2.0 only. No passwords are stored. No MFA is available because there is no password to protect — security is delegated to Google's authentication.
• Session management: Sessions last 7 days. Each session is a row in the database. A JWT with a unique `jti` (session ID) is validated on every request against the session row. Deleting the session row invalidates the token immediately.
• Single-use OAuth exchange: The JWT is never exposed in a URL or browser history. A short-lived, single-use exchange code delivered via HttpOnly cookie is used to complete sign-in, making replay impossible.

Tenant Isolation

Every major entity in Asphalyn belongs to exactly one workspace. Workspace isolation is enforced at the database query layer:

• Every workspace-scoped request includes a workspace identifier verified against membership.
• Every database query uses scoped accessors (`findOneScoped`, `updateScoped`, `deleteScoped`) that require an explicit workspace scope.
• Cross-tenant records return a 404 response, indistinguishable from non-existence. A user in Workspace A cannot tell whether a record in Workspace B exists.
• Workspace-scoped creates and reorders are serialized using PostgreSQL advisory locks to prevent race conditions.

Attachment Security

• Files are uploaded directly from the browser to Backblaze B2 using presigned PUT URLs. File bytes never pass through the API tier.
• The presigned URL signs both `Content-Length` and `Content-Type`. B2 rejects any upload whose actual size or content type differs from what was declared.
• Object keys are prefixed with the workspace ID and generated server-side. The client cannot choose the key.
• Both the backend and frontend refuse any object key that does not begin with `workspaces/<workspaceId>/` and any URL that is not the trusted Backblaze B2 host.
• Attachment limits: 100 MB per file, 50 per HAZOP study, 25 per node. Count checks run inside an advisory lock, so concurrent uploads cannot exceed the limit.

Data Residency

Asphalyn stores customer data in the European Union and the United States. Application hosting (frontend and backend) is provided by Vercel Inc. with all serverless functions running in the EU Central region (Frankfurt, Germany — fra1). Database hosting is provided by Aiven Ltd, running on DigitalOcean infrastructure in Amsterdam, Netherlands (ams3). Database backup storage is located in Bangalore, India (do-blr1). Attachment storage is provided by Backblaze, Inc. in the US East region (Reston, Virginia — us-east-005). We do not currently offer region selection.

We do not currently offer region selection. If your organization requires data to be stored in a specific jurisdiction, contact us at contact@asphalyn.com before uploading that data. We would rather have that conversation upfront than discover it later.

Data Deletion and Retention

Workspace deletion: Workspace data (studies, nodes, rows, actions, incidents, LOPA analyses) is deleted immediately when a workspace is deleted. There is no soft-delete or grace period at this time.

Attachments: Attachment objects are deleted from Backblaze B2 when the parent entity (HAZOP study or node) is deleted, or when the attachment itself is deleted. Because our current deployment runs on Vercel serverless functions, deletion of B2 objects is fire-and-forget: if the function terminates before the deletion completes, an orphaned object may remain in the bucket. A queue-based fix is scaffolded but not active. We do not currently run a periodic orphan sweep.

Backups: Aiven free-tier (Hobbyist) PostgreSQL services do not include automatic backups with point-in-time recovery. A single backup for disaster recovery may be available. No retention period applies because no scheduled backups are stored. This means that if the database is lost or corrupted, we cannot restore it from a backup. You should maintain independent copies of any data you cannot afford to lose.

Billing records: Asphalyn does not store billing records or payment card data. All billing is handled by Paddle, our merchant of record. Paddle retains billing records according to its own policies and applicable tax law. You can view and download invoices from the Paddle customer portal.

For the full retention schedule, see our Privacy Policy.

Compliance

• GDPR and UK GDPR: Asphalyn processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR where applicable. We act as a data processor for customer workspace data and as a data controller for account and billing data.
• POPIA (South Africa): Asphalyn processes personal information in accordance with the South African Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is Muhammad Uzair, who can be contacted at contact@asphalyn.com. You have the right to lodge a complaint with the South African Information Regulator at inforegulator.org.za.
• Certifications: Asphalyn does not currently hold SOC 2, ISO 27001, or any other security certification. We do not claim to hold any certification we have not achieved.

Subprocessors and DPA

Our current subprocessor list is available at /subprocessors.

A Data Processing Agreement (DPA) is available at /dpa. You can also request a countersigned copy by emailing contact@asphalyn.com.

Reporting a Security Issue

If you believe you have found a security vulnerability in Asphalyn, please contact security@asphalyn.com. We will acknowledge your report within 2 business days. We do not currently operate a bug bounty program, but we will credit responsible disclosure if you wish.

What We Do Not Claim

• We do not hold SOC 2, ISO 27001, or any other security certification.
• We do not offer end-to-end encryption or customer-managed encryption keys.
• We do not offer per-tenant database isolation.
• We do not guarantee recovery of any specific data from backups, because our current database plan does not include automatic point-in-time recovery.
• We do not offer MFA beyond whatever Google provides for your Google account.
• We do not have a 24/7 security operations center or a formal incident response team.

These are real limitations. We would rather state them plainly than have you discover them during a security review.