Errly is built around one rule: all Service Data is processed in the EU, by EU-incorporated companies. Operational sub-processors (billing, marketing-site CDN, domain administration) follow standard SaaS practice and are listed transparently with their transfer mechanisms; none of them ever receives Service Data. The sections below cover the rest.
01Data residency
Ingestion, storage, and processing of Service Data run on Hetzner (Frankfurt, Germany) and Aiven managed PostgreSQL + ClickHouse (Helsinki, Finland). Both providers are EU-incorporated. Object storage for source maps and attachments is on Hetzner Object Storage, intra-region redundant. See the full sub-processor list.
02Encryption
- In transit: TLS 1.2 or higher for all customer-facing endpoints and inter-service traffic.
- At rest: managed-database default encryption (Aiven AES-256) for Postgres and ClickHouse; provider-default encryption for Hetzner Object Storage.
- Secrets: DSN secret keys are stored hashed at rest; rotation is available from project settings.
03Authentication
Magic-link email authentication only — no passwords to phish or leak. Sessions are short-lived, signed, and bound to the originating user agent class. SSO support (SAML, OIDC) is on the roadmap; magic-link is the only authentication method in v1.
04Backups & recovery
Aiven Point-in-Time Recovery is enabled for both PostgreSQL and ClickHouse with retention windows appropriate to each data class. Restore tests run monthly against an isolated environment. Source maps and attachments are intra-region-redundant on Hetzner Object Storage; we do not maintain a second copy because they are replaceable from the customer's build pipeline.
05Incident response
Customers will be notified of any incident affecting their Service Data without undue delay, and within seventy-two hours, in accordance with our DPA. Notifications are sent directly by email to the account's notification contact.
06Vulnerability reports
Send vulnerability reports to security@errly.eu. We acknowledge within two business days. We do not currently operate a paid bug-bounty programme; we will publicly credit responsible reporters who request it. Our security.txt contains the canonical contact details.
07What we don't claim
We do not currently hold SOC 2, ISO 27001, or any other third-party audit certification. If your procurement requires one, Errly is not the right fit at this stage. We say this up-front to save your time. We may pursue one of the above once revenue and team size justify it; we will not list it as "in progress" on our marketing site until it is.