Trust Center

One URL for a vendor security review: subprocessors, data residency, retention proof, DPA, and attestation roadmap. If your procurement team needs a CAIQ / SIG questionnaire completed, email security@ephemera.sh — most of the answers are below.

At a glance

Subprocessors

Third parties that may process customer or account data. Region is where the relevant processing happens for EU tenants. Effective 2026-06-04. We give at least 30 days' notice before adding or replacing a subprocessor that processes your data on our behalf. Vendors we engage for our own billing are disclosed in our privacy notice, not here.

Data residency & the AI layer

For stored data, EU-tenant cluster dumps, findings, PDFs and the control-plane DB stay in EU infrastructure; US in US. The EU and US deployments run on separate, region-pinned databases (EU on Scaleway, US on DigitalOcean), and a tenant's record lives solely in its home-region database — there is no cross-region replication.

The AI layer is region-local too. Each region calls its own LLM provider directly, at that provider's in-region endpoint — EU tenants to Mistral in France, US tenants to Anthropic in the US — with no shared cross-region aggregator in the path. Prompts are built from redacted findings only (no secrets, no raw manifests), so an EU tenant's text stays in the EU. Provider-side retention and no-training commitments are a separate contractual matter covered by each provider's DPA. See our routing notes for detail.

Retention & deletion proof

Raw artifacts auto-delete within 24 hours. Every deletion is written to an append-only, ed25519-signed retention log, so you can independently verify a given artifact was destroyed. See the retention policy.

How a deletion becomes a signed receipt:

1. in your browser

   Redact & upload

   Secrets stripped client-side; the redacted dump uploads over TLS to your region.

3. region-pinned storage

   Versioned + deadline

   Object storage in your region; a delete_at of upload + 24h is set at write time. EU uploads add Object-Lock (WORM) write-once enforcement.

5. retention-cron · * * * * *

   Delete & hash

   Every minute, past-deadline objects (every version) are deleted and each one's SHA-256 recorded.

7. write-only log · kept forever

   Signed receipt

   An ed25519-signed entry is appended to a separate, write-only log bucket — provider- and region-specific (Scaleway for EU, DigitalOcean for US) and replicated to a second region in the same jurisdiction for disaster recovery — and retained permanently.

Each retention-log entry is ed25519-signed over all of the following fields, joined in order — so altering any one of them invalidates the signature:

To verify offline, recompute two things and check them against the published public key:

• The hash chain. entry_hash is the SHA-256 of the entry with entry_hash and signature removed, serialized as compact JSON with sorted keys ({"a":1}-style, no spaces). Each entry's prev_hash must equal the previous entry's entry_hash, and seq must be contiguous — so any edit, deletion, or reordering breaks the chain.
• The signature. Each entry is ed25519-signed over the canonical message — the fields joined with | in exactly this order, with each deleted object appended as its own segment:
  seq | prev_hash | entry_hash | timestamp | job_id | tenant_id | region | verb | age_seconds | <deleted_object_1> | <deleted_object_2> | …
  (tenant_id is the empty string for the scheduled sweeps that aren't tied to one tenant). Verify that string's signature with our public key.

The log lives in a dedicated, versioned, private bucket on your data plane's provider and region — EU (Scaleway) or US (DigitalOcean) — never public. The cron holds PutObject only, so entries can be appended but never edited or deleted, and every entry is replicated to a second region within the same jurisdiction for disaster recovery (the copy never leaves your region). It is reachable only through the authenticated dashboard, scoped to your own tenant: use Download signed log (JSON) under Trust → Retention log to export the whole signed entries and verify them offline as above.

Documents

• Data Processing Agreement (DPA) (PDF, GDPR Art. 28) — draft pending legal sign-off.
• Data-flow diagram — SVG · PDF.
• Security policy (scope, safe harbour, disclosure SLA).
• security.txt.
• Status page — deletion-cron heartbeat + published retention public key. External uptime monitoring still being set up.

Questions a questionnaire doesn't cover? security@ephemera.sh.