Scope and reporting
This page supports Redomon’s global B2B SaaS. The operator is based in Argentina; the service is not limited to the Argentine market. Applicable privacy and other mandatory laws depend on the relevant processing and jurisdiction.
Redomon is operated by Manuel García Nicastro, CUIT 20-50046009-2, La Plata, Argentina. Report security concerns privately to hello@redomon.com with enough detail to reproduce the issue, without exposing other customers’ data. Do not send passwords or live secrets. No paid bounty or permission to test third-party infrastructure is implied.
Platform and access requirements
Redomon uses Cloudflare-hosted services, Neon PostgreSQL and Clerk authentication and organizations. Polar handles paid purchases as merchant of record; Redomon does not collect full card details in its interface. Our security requirements include authenticated organization context, server-side workspace and product permissions, restricted browser origins, request-size controls and signed billing-webhook validation. These controls do not eliminate every risk.
Mail, AI and analytics
Mailbox access credentials or tokens must be encrypted, access-restricted and excluded from application output and logs. IMAP and SMTP connections require protected transport and authorized mailbox access. AI processing is subject to the DPA’s provider disclosure, written-contract and verified zero-retention requirements. Analytics access and CRM-contact linking must respect workspace permissions; event properties and uploaded documents or files must not bypass sensitive-data restrictions.
Product Analytics processes customer-defined event names, timestamps, page paths, sanitized properties, referral hostnames and daily pseudonymous visitor digests. The collector strips URL queries and fragments. A daily HMAC uses request IP and user agent without persisting raw IP addresses or raw user-agent strings in analytics records. The tracker uses no analytics cookies or browser storage and honors DNT/GPC. This does not describe separate hosting security metadata or remove the customer's responsibility for lawful collection, notices and any required consent. Customers must not send passwords, payment-card details, personal data or sensitive information in event names, properties or URLs. Product Analytics is customer-instructed processing, not permission for Redomon to track people across customers for advertising.
Processing locations
The primary Neon PostgreSQL database for CRM and Product Analytics is in Frankfurt, Germany (eu-central-1). Cloudflare Workers execute at the edge, Queues provide global event-delivery transit, and Durable Objects store pending sanitized events in a durable outbox and retain deduplication and billing receipts outside the primary database. Frankfurt is a primary-database region, not a guarantee for Workers, Queue transit, Durable Object storage or all processing. Provider operations and support, separately retained backups, object storage, customer-selected mailbox services, disclosed AI processing and necessary operator access from Argentina may involve other countries under applicable transfer safeguards. No EU-only processing or Frankfurt object-storage guarantee is made.
Security and deletion obligations
Our DPA sets requirements for access control, encrypted transport and provider-supported encryption at rest, confidentiality, secret management, proportionate logging, recovery, incident response, export and deletion. Active-system deletion and restricted backup expiry follow the privacy notice and DPA, including shorter applicable rights deadlines. This overview does not claim SOC 2 or ISO certification, an independent penetration test, end-to-end encryption, a particular encryption algorithm or a recovery objective.
Product Analytics raw events retain the current UTC day and the prior 89 days in native PostgreSQL daily partitions. An hourly maintenance job at minute 0 UTC attempts physical DROP of expired daily partitions and removes expired rollups. Failed maintenance is monitored and retried; this calendar-day window is not an exact per-event 90-day erasure deadline. Accepted events use Queue delivery retries and a dead-letter queue for recovery, with a durable outbox and deduplication and billing receipts outside the primary database. Pending outbox payloads remain until delivery or explicit recovery; the primary-database partition schedule does not expire them. Delivered-event receipts are eligible for alarm-driven cleanup 90 days after admission, not at an exact deletion deadline. Provider backups have a separate retention lifecycle; partition deletion does not establish that backup copies are erased within 90 days. Restricted copies remain isolated from ordinary use, and deletion instructions are reapplied after restoration. Applicable rights deadlines and lawful customer deletion instructions take priority.
Incident notification
If we become aware of a personal data breach affecting customer data, we notify the customer without undue delay, provide the information then available and supplement it as facts develop, as described in the DPA. An incomplete investigation does not delay initial notice. This is not a promise that every incident is detected within a fixed number of hours.
Customer responsibilities and availability
Use strong account security, review organization membership and roles, minimize synchronized data, and keep independent copies of important records. No system is risk-free. No contractual uptime SLA or service credit applies unless separately agreed, and Starter includes no SLA. Contact us for a current security description or a security question about your workspace.