Security

1. Where your data lives

Prodsure runs on Google Cloud. Accounts, saved catalogs and matches are kept in a managed PostgreSQL database in Frankfurt, Germany. The database accepts only authenticated, encrypted connections from the application and the nightly check.

2. Encryption

• All traffic between your browser and Prodsure uses HTTPS.
• Data in the database and its backups is encrypted at rest by Google Cloud.

3. Sign-in and sessions

• Sign-in is handled by Firebase Authentication. We never see or store your password.
• Your session is kept in a cookie that scripts cannot read, is sent only over HTTPS and expires after 14 days.
• Requests that change data are accepted only from our own site.
• Each catalog belongs to one account, and every request is checked against that account.

4. Uploaded files

A file uploaded to the free check is read to build the report and is not saved. Catalogs are stored only when you save them to your account, and you can delete them at any time.

5. How we work

• Passwords and API keys of the service are kept in a secret manager, not in the code.
• Access to production is limited to the people who need it.
• Every change to the code goes through automated tests before a release.
• Emails are sent from a verified domain with SPF and DKIM.

6. If something goes wrong

If a security incident affects your data, we tell you by email without undue delay and report it to the data protection authority where the law requires. See also the Privacy Policy and the Data Processing Agreement.

7. Report a vulnerability

Found a security problem? Write to contact@prodsure.eu with the steps to reproduce it. Please give us time to fix it before you make it public, and do not access or change other people’s data while testing. We answer every report.