Legal
Security overview
Last updated: September 2026
A summary of the technical and organisational measures protecting Reply Fast and the data entrusted to it.
Draft for legal review
This page contains placeholders marked “Needs legal review”. They must be completed and verified by qualified legal counsel before this page is relied upon.
1. Hosting and data residency
The application and database run on European infrastructure (Hetzner, Germany/Finland). Personal data is not moved outside the EU without a lawful transfer mechanism.
2. Tenant isolation
Every organization's data carries a tenant identifier and is protected by PostgreSQL row-level security policies as a backstop to application checks. Isolation tests run in continuous integration and block releases.
3. Encryption
Traffic is encrypted in transit with TLS. Channel credentials, API keys and the pseudonymization vault are encrypted at rest with AES-256-GCM. Passwords are stored as salted hashes.
4. Authentication
Accounts support two-factor authentication (TOTP) with backup codes, passkeys, and session revocation. Platform administrators must enable two-factor authentication. Sign-in and reset endpoints are rate limited.
5. AI safety
Personal data is pseudonymized before any model call, models are reached only through a routing layer with an ordered fallback chain, and the assistant answers only from tenant-owned content.
6. Audit and monitoring
Administrative and sensitive user actions are written to an append-only audit log. Webhooks verify signatures and de-duplicate messages before any processing.
7. Responsible disclosure
If you believe you have found a vulnerability, email Needs legal reviewsecurity contact email. We will acknowledge reports within Needs legal reviewacknowledgement time and keep you informed while we fix the issue.