Security
What we do, and what we do not claim
This page lists behaviour we have checked against the code. For the binding terms read the Privacy policy and the Terms, which are drafts pending legal review.
In place
How the service protects your data
- Isolation in the database
- Every table is under forced row-level security. Each request runs in one transaction that sets the caller’s organization first, and another organization’s data answers 404 exactly as missing data does. The web process holds no database owner credentials.
- Presigned, short-lived file access
- Uploads and downloads use presigned links under your organization’s prefix. A link is valid for at most 15 minutes. Link issuance is audited and the link itself is never logged.
- API keys
- Only a SHA-256 hash is stored. The key is shown once, can carry an expiry, and an admin can revoke it. Credential checks use one uniform answer for every failure.
- Audit and limits
- Administrative and security actions go to an append-only audit log. Requests are rate limited per address, key and organization, and request bodies and fields are strictly validated.
- Transport and browser
- HTTPS with HSTS, a strict Content-Security-Policy with no inline scripts beyond one hashed theme bootstrap, frame denial, and no CORS granted to any origin. Fonts are served from our own origin.
- Payments
- Stripe handles card details. Credit is granted only from Stripe’s signed confirmation, applied once per payment.
- No trackers
- No analytics or advertising scripts on this site or in the console. The console sets no cookies of its own; the sign-in provider sets its own.
- Your data, your control
- Organization admins can export data and request deletion from Settings. Deletion starts after a 7-day grace period you can cancel, needs our approval, and ends with a signed certificate. The certificate lists what is kept (the spend ledger and payment records, and a redacted audit log) and what we do not delete (sign-in, payment and compute providers’ own records, backups and hosting logs).
Not claimed
Things we do not say
Leaving these out is deliberate.
- No certifications. We hold no SOC 2, ISO 27001 or similar attestation and do not claim compliance with any framework.
- No statement on model training yet. The Privacy policy says your content is used to operate, secure and bill for the service. It does not yet make a promise either way about training models on it, so this site does not either.
- Data location. Providers run in the United States and other countries; we have not committed to a single region.
Reporting
Found a problem?
Write to privacy@observolabs.com. More detail is in the security documentation, the Privacy policy and the Terms.