Security

Hosting and data residency

Hosting, stored data and transactional e-mail stay in the EU (Hetzner Online GmbH: Germany and Finland; SMTP2GO: EU data centre). Payments (Stripe) are planned; see our subprocessors page.

Encryption

All traffic between your systems and TerraRelay is encrypted in transit with TLS.

API keys

API keys are stored only as hashes. We cannot read a key back; it is shown once, when you create it.

Data minimisation in logs

We do not store full search queries long-term and we do not keep addresses as analytics data. Technical metadata, such as latency and status codes, is kept. More detailed request data is only recorded when needed for analysis, for example for errors, timeouts or anomalies. This diagnostic data is temporary, access-restricted, purpose-bound and deleted automatically.

Access control

Access to production systems and diagnostic data is restricted to those who need it to operate the service.

Incident communication

We communicate incidents and planned maintenance by e-mail to affected customers. A public status page will follow.

Contact

Questions about security: security@terrarelay.eu. To report a vulnerability, see our vulnerability disclosure policy.