en
Request Service
Request Service Sign in

Security

Security, stated plainly.

Your compliance and security teams will ask these questions before the first conversation. Here are the answers: what the product does today, and what is not in place yet.

What we store, and what we never store

In place

Your perimeter is a list of wallet addresses with a few facts about each. The link from your subject code to a real person stays with you and never reaches us.

Stored

  • Wallet address
  • Relationship: employee, partner or client
  • Start and end of the relationship
  • Your own subject code

Never stored

  • The person's name
  • Their email address or phone number
  • Their staff ID

Apart from the pseudonymous perimeter, the personal data we hold for you is the work email and name of each person you give access to the cabinet.

One client never sees another

In place

Every client table carries the client's identifier and runs under PostgreSQL row-level security, enforced even for the table owner. A query without a client context returns nothing, and the application's own database role owns no table, so it cannot step around the rule. A cross-client leak test is part of the suite every change must pass.

Sign-in, and the second factor we recommend

In place

Every sign-in starts with a one-time code sent to your work email. We recommend that everyone on your team turns on a second factor in the cabinet settings on day one. There are two ways to do it.

  • Passkey Phishing-resistant

    Your fingerprint, face or device screen lock. There is nothing to type, and a look-alike site cannot use it: a passkey only works on the real DEVIATIC address.

  • Authenticator app

    A six-digit code from Google Authenticator or any compatible app, renewed every thirty seconds.

Sessions end after a period without activity and have a fixed maximum length. We never use SMS codes. DEVIATIC operators always sign in with a second factor.

Every action on the record

In place

Every action in the cabinet is written to an append-only journal, and each record is chained to the one before it by a keyed hash: an edited or deleted entry breaks the chain. An extract for your company is available on request.

A report leaves the cabinet only through a signed link that lives ten minutes, works once and belongs to the session that asked for it. The report itself shows who exported it and when.

Logs and telemetry never carry wallet addresses, subject codes or email addresses. Error reports carry an internal identifier of your company and nothing else from your data.

Where data is kept

By design, client data is stored inside the European Union.

Database and application servers
Hetzner, Helsinki, Finland
Report files and service data
Cloudflare R2 under EU jurisdiction. The service will not start with a storage address outside the EU.
Telemetry
Grafana Cloud, Germany
Error reports
Sentry, EU region in Frankfurt

Blockchain data and address attribution providers receive only the wallet addresses we look up, and some of them are outside the European Union: they receive no subject codes and no relationship types.

Subprocessors

We work with a small number of infrastructure, blockchain data and address attribution providers. The named list, with the role and location of each, is given to clients with the contract and to companies in a due diligence review under a non-disclosure agreement.

Audits and certification, stated plainly

Not yet
ISO 27001 and SOC 2
No certificate yet.
Independent penetration test
Not done yet. It comes first, starting with client isolation, report export and access control.
Order of work
Penetration test first, then ISO 27001. SOC 2 when a client asks for it in writing.

Documents for your due diligence

  • Data processing agreement under Article 28 GDPR Not yet
  • DORA contract terms: incident notice, audit rights, exit plan and prior consent to subcontracting Not yet
  • Answers to the SIG Lite and CAIQ Lite questionnaires Not yet
  • An extract of the audit journal for your company

Ask for any of them through the request form.

Open now, without a request: a sample report and a sample case file on invented data.