Trust Center
Security is not a feature.
It is the architecture.
DevSafe encrypts your code before it leaves your machine. Your keys never touch our servers. Your backups live in your own storage.
Private by Design
We can not read your code. Your key is never sent to DevSafe.
User-Owned Keys
You generate the key. You hold the key. We never see it.
Your Storage
Backups go to your Cloudflare R2 or S3 bucket. Not ours.
Git-Aware
Makes a git bundle, git's own export format. Never writes to your .git directory.
Verifiable
Check any backup is restorable, on your own machine. Proof, not promises.
No Training
Your code is never used to train models. Never shared. Never sold.
What we enforce
Security controls
Need to map these against your vendor questionnaire? Read the pre-filled SIG Lite with all 19 risk domains answered.
Encryption
- AES-256 authenticated encryption
- Keys created on your machine and never sent to DevSafe
- TLS 1.2 or higher to DevSafe infrastructure and storage providers.
- Encryption at rest on all infrastructure (Supabase)
- HTTPS enforced. No HTTP connections accepted.
- Large repositories supported.
Application Security
- Encrypted git bundles (git's own export format), not filesystem copies
- Snapshot verification before encryption
- Parameterized queries on all database access.
- CORS locked to devsafe.com only
- Rate limiting on all API endpoints
- Input validation on every request
- Security headers (HSTS, CSP, X-Frame-Options)
Access Control
- User-generated encryption keys. Never sent to or stored by DevSafe.
- Email and password, magic link, or GitHub OAuth authentication. Optional TOTP multi-factor authentication. Passwords hashed by Supabase Auth, never accessible to DevSafe.
- API key authentication for programmatic access
- Principle of least privilege for all systems
- Role-based access (Owner, Member) for team plans
Infrastructure
- DDoS protection via Cloudflare
- Web Application Firewall (WAF)
- Bot detection and blocking
- Immutable deployments with instant rollback
- Private networking between services
- Automated SSL certificate provisioning
Audit
- Backups verifiable on your machine, with a proof file you can share with an auditor
- Tamper-evident audit logs
- Backup integrity verified on restore
- Your backups stay in your own storage. No lock-in. Account data export on request.
- Restore with the free DevSafe program and your key, no account needed
Organizational
- All systems use environment variables for secrets
- No customer data used for training. Ever.
- No advertising or third-party tracking tags in our code (Cloudflare may count visits without cookies)
- Incident response plan documented
- Sub-processor list published and maintained
- GDPR Data Processing Agreement available
Backup verification
Every snapshot is checked before it is encrypted, and you can check any backup is intact and restorable whenever you like. Not "probably fine." Checked.
AES-256
Encryption
Tamper
Evident
Local
Keys Stay Home
Verified
Integrity
Run devsafe verify to check a backup is complete, unchanged and restorable, or devsafe restore --verify to test-restore every project into a temporary folder. Both run on your machine.
The free DevSafe program restores them with just your key: no account, no login, no DevSafe server. No vendor lock-in.
Compliance status
GDPR
Aligned
Privacy by design. Your code is encrypted on your machine with a key only you hold, so we can not access your code or backups even if compelled. DPA in draft, available on request after legal review. Data subject rights supported. EU hosting option via R2.
CCPA
Aligned
No sale of personal data. Consumer deletion supported. Privacy policy addresses CCPA requirements.
SOC 2 Type II
Roadmap
Controls implemented. Compliance platform evaluation in progress. Observation period target: 2027.
HIPAA
In Prep
Encryption on your machine, with keys only you hold, addresses several HIPAA technical safeguards. BAA template in preparation. All plans use user-owned storage.
ISO 27001
Planned
Targeted for enterprise expansion. Significant overlap with SOC 2 controls already in place.
Sub-processors
These are the third-party services that may process data on your behalf when you use DevSafe. This list is maintained per GDPR Article 28. We notify customers of changes.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Database, sign-in, server functions | Account details, plan and billing records, project records sent by the signed-in DevSafe program (project names, folder paths, remote addresses, backup sizes, commit IDs, scan findings), signup check records, email list, form entries, Ask Voss questions, server logs | US (EU option) |
| Cloudflare | Website hosting, DNS, DDoS protection, WAF, CDN, SSL/TLS | Visitor request data (IP address, browser headers, pages requested). May count visits with its cookie-free Web Analytics. | Global edge |
| Stripe | Payment processing | Your email address, DevSafe user ID and plan choice; the card details you enter at Stripe checkout (DevSafe never sees card numbers) | US |
| Resend | Email delivery | Email address, email content (including contact form messages) | US |
| Web fonts; team inbox (Google Workspace) | Visitor IP address and browser details (fonts); contact form messages (inbox) | Global | |
| Anthropic | Answers to the Ask Voss box on blog posts | The question typed and the text of the blog post | US |
| jsDelivr | Delivers the sign-in library to browsers | Visitor IP address and browser details | Global edge |
| GitHub | GitHub sign-in, DevSafe downloads, the program's daily update check | GitHub profile basics (GitHub sign-in); IP address and request details | US |
Your data stays yours
Your code and backups are not processed by any sub-processor. Encrypted backups go directly from your machine to your own storage bucket. DevSafe never has access to your encryption keys or your backup contents. If you sign in the DevSafe program, Supabase stores the project records listed above: facts about your projects, not their contents.
How we handle your data
We never see your code
Your encryption key is generated locally and never sent to DevSafe. Backups are encrypted before leaving your machine and sent directly to your own cloud storage. The DevSafe program uploads only encrypted files to your storage, and we cannot decrypt them.
We never train on your data
Your code, queries, and backup contents are yours. They are never used to improve models, never shared with third parties, never sold. This is architectural, not policy. We cannot train on what we cannot see.
Export everything, anytime
Your backups are AES-256 encrypted snapshots in your own storage. The free DevSafe program restores them with just your key: no account, no login, no DevSafe server. No lock-in.
Delete your account on request
Ask us to delete your account. We comply within 30 days per GDPR Article 17. Its profile, project, scan, backup and plan records are deleted with it. Signup check records stay without the link to your account, and Stripe keeps payment records under its own rules. Your encrypted backups in your own storage remain yours to keep or delete.
Documents
Privacy Policy
GDPR + CCPA aligned.
Terms of Service
Updated October 2026.
Accessibility Statement
WCAG 2.1 AA target. Deaf founder.
Security & Threat Model
Full architecture and threat model.
Data Processing Agreement
DPA in draft, available on request after legal review.
Business Associate Agreement
BAA template in preparation.
Security Questionnaire
Pre-filled SIG Lite. 19 domains, answered proactively.
Questions about security?
We respond within 24 hours.
For security-specific inquiries, responsible disclosure, or compliance document requests, contact the security team.