Security

1.Our approach

This page describes the security measures in place today. It is a plain description of what we do, not a certification. If your team needs more detail for a security review, write to [email protected].

2.Where your data is stored

• The application, database, file storage and backups run on servers Caudals operates at Hetzner, in Germany.
• By default, test questions are written and answers graded by an AI model that runs on our own GPU server, connected to our hosting over a private encrypted tunnel. Your content goes to a commercial AI provider only if your workspace chooses one, or in the free public test when our model is busy.
• The database and file storage are not reachable from the public internet.

3.Encryption

• All traffic to our websites and API uses HTTPS (TLS).
• The credentials you give us to reach your systems, such as API keys and headers, are encrypted by the application with AES-256-GCM before they are stored, bound to your workspace, and decrypted only by the worker that needs them. Credentials entered in the free public test are never stored.
• Passwords are stored only as salted hashes.
• Backups are encrypted with AES-256.

4.Separation between customers

• Each workspace's data is kept separate in the database with row-level security. The application connects with a restricted role that cannot bypass those rules, and every background job runs within the scope of its own workspace.
• Reports are shared only through private links, which you can set to expire and revoke at any time.
• Experts working on an order see only the redacted material their task needs.

5.Access control

• Workspace members have owner, editor or viewer roles, and the server checks the person's role for every action.
• Caudals staff access to customer workspaces is limited to platform roles and recorded in an audit log.
• Our servers can be administered only over a private network with key-based authentication. There is no public SSH or database access.

6.Testing other systems safely

• Website chats are tested in an isolated browser worker whose network traffic goes through a proxy that allows only public HTTPS destinations.
• The free public test checks every address and redirect, limits the time and size of every request, and reads at most six pages of a site.
• We ask ordinary questions only. We do not get around CAPTCHAs or logins: when a website needs a person, the run waits for one. We never run adversarial tests without the written authorization of the system's owner.

7.Keeping only what is needed

• Free public tests are deleted after seven days, and so are the screenshots captured while testing website chats.
• Deleting a workspace revokes its share links and credentials, stops its jobs and deletes its content from our live systems, keeping only a minimal record that the deletion took place.
• Routine daily backups are encrypted and retained for about a week. Restricted recovery archives may be retained longer. We have rehearsed restoration in an isolated environment.

8.Monitoring and development

• Error monitoring can be enabled with Sentry in its EU data region. The integration excludes personal data by default.
• Public endpoints are rate limited, and the free public test uses a proof-of-work check instead of a third-party CAPTCHA.
• Important actions, such as changes to roles, budgets, shares and deletions, are recorded in an audit log.
• Our release process includes type checks, tests and checks for sensitive data. Dependencies are checked for updates.

9.Reporting a vulnerability

If you find a security issue, write to [email protected] with “Security” in the subject. Please give us reasonable time to fix it before disclosing it, and do not access other people's data or disrupt the Service while you investigate. We will acknowledge your report and keep you informed.