Documentation

Security and privacy

Where data lives, how it is protected and who can access it.

Data location: database and files in the EU (Supabase, Frankfurt); the app runs in Frankfurt (Vercel fra1).
Database access: Sidro tables have no public access — only the app server reads them, always scoped to your organisation.
Integration credentials are encrypted with AES-256-GCM.
API keys are stored only as SHA-256 hashes; revocation is immediate.
Team roles: owner, admin, editor, viewer. Only the owner manages billing.
URLs you enter are fetched with protection against internal-network access (SSRF).
Audit trail of anchor prices cannot be modified.
Cookies: essential only.