Security

Security is foundational to Production Central. This page summarizes the technical and organizational measures we use to protect customer data.

1. Infrastructure and hosting

The Service runs on reputable cloud infrastructure — Railway (application, PostgreSQL database, and Redis cache, hosted in the EU) and Cloudflare (DNS, CDN, security, and R2 file storage) — whose data centers provide physical security, redundancy, and environmental controls. Production environments are logically separated from development and testing.

2. Encryption

Data is encrypted in transit using TLS and at rest using industry-standard algorithms (such as AES-256). Secrets and keys are managed through a dedicated key-management service.

3. Access control

We enforce least-privilege access, role-based permissions, and multi-factor authentication for internal systems. Access to production data is restricted, logged, and reviewed periodically.

4. Application and network security

• Secure development practices, code review, and dependency scanning.
• Network segmentation, firewalls, and protection against common web vulnerabilities.
• Centralized logging and monitoring with alerting on anomalous activity.

5. Vulnerability management and testing

We perform regular vulnerability scanning and remediation and engage independent third parties for periodic penetration testing. Researchers can report issues under our Vulnerability Disclosure Policy.

6. Resilience and backups

We maintain regular encrypted backups and business-continuity and disaster-recovery plans designed to restore the Service in the event of disruption.

7. Compliance and personnel

As an early-stage product we do not yet hold formal third-party certifications such as SOC 2 or ISO 27001; we follow the practices described above and rely on the certifications maintained by our infrastructure providers (Railway and Cloudflare). Access to production data is limited, and personnel receive security-awareness guidance.

8. Incident response

We maintain an incident-response plan and will notify affected customers of security incidents that materially affect their data in accordance with applicable law and our Data Processing Addendum. Report security concerns to [email protected].