cloudtifactSecurity
Your work stays yours.
New pages are private to your team until you share them. Here's where your data lives, who can see it, and what our own staff can do. We keep what's live today apart from what's coming soon.
Where things stand
- Private until you shareLive
- Encrypted on the way and on diskLive
- Staff visits are written downLive
- Encryption you switch onLive
- A log of who opened whatLive
- Every version kept, yours to deleteLive
- Every staff visit shown to youComing soon
- Saved answers encrypted tooComing soon
What's true today.
Private until you share
A new page is seen only by members of your workspace. You choose when to make it public, and you can put a password on it.
Encrypted on the way and on disk
Everything travels over HTTPS. It's stored on our servers, encrypted on disk.
Staff visits are written down
Our staff use a separate admin panel that only named staff can sign in to. Every page they open there and every action they take goes into a log they can't edit. Seeing someone's full email, or taking any action, needs a written reason.
Encryption you switch on
Turn on encryption for any space in its Settings, on any plan. Its name, page titles, version notes, comments, uploaded files and every page you publish are then stored encrypted, with the space's own key, so nobody who opens our database or storage can read them, our staff included. Your team, your links, the CLI and your agents work as before. On a Team plan, owners can have every new space start encrypted.
A log of who opened what
For each encrypted space, workspace owners see who opened, downloaded, pushed to, commented on or changed it, and when: your team, guests, people with the link, agents, and our staff with the reason they gave. Each entry is chained to the one before, and once a day we store the chain's latest link where nobody, us included, can change or delete it, so a deleted or changed entry shows. Entries are kept for a year, and owners can download them as CSV or JSON.
Every version kept, yours to delete
Each change to a page is kept, so nothing is lost by mistake. Delete your account and your data goes with it; backups roll off within 30 days. What deletion removes
Coming soon.
This page will say when each one is live.
- Coming soon
Every staff visit shown to you
Your Activity page will show every time our staff open your workspace in our admin panel, with their reason, not only what they do to your encrypted spaces.
- Coming soon
Saved answers encrypted too
Encryption doesn't cover the data your pages save yet, like form answers. Who reads or writes it is already in the log.
Where your data lives
Your pages, databases and files live on our servers, encrypted on disk and in transit. Clerk handles sign-in, and Stripe handles payments through Autumn. We don't sell your data. Who else handles your data
Your data is kept in our hosting provider's data centres. You can't pick a country or region today.
What we don't claim
Cloudtifact isn't end-to-end encrypted. We keep the keys, because our servers read a page to show it to you. Even with encryption on, the few people who can deploy our code could still reach your data, and our hosting provider's audit log records what they change. Encryption covers a space's content, not the data its pages save or people's names and emails.
We don't have SOC 2, ISO 27001 or HIPAA certification. If you need one of those, or want to see how something works, write to security@cloudtifact.com.
Questions people ask.
Can Cloudtifact staff read my pages?
Our servers can, because they show your pages to you. Staff who open your workspace in our admin panel are written to a log they can't edit. Turn on encryption for a space and its titles, comments and files are stored encrypted, our admin panel can't show them, and anything our staff do to it shows in your access log with their reason.
Where is my data stored?
On our servers, encrypted on disk. You can't pick a region today. Who else handles your data
Is Cloudtifact end-to-end encrypted?
No. Our servers have to read a page to show it. Turn on encryption for a space and its titles, comments and files are stored encrypted, with a key per space.
Do you have SOC 2?
Not today, and no ISO 27001 or HIPAA either. Write to security@cloudtifact.com if you need to know how something works.
Can I delete everything?
Yes. Delete your account in Settings; it's gone 7 days later, and backups roll off within 30 days. Messages you wrote in spaces shared with others stay, shown as 'Deleted user'. What deletion removes
How do I report a security problem?
Email security@cloudtifact.com.
Something we didn’t answer?
Write to us at security@cloudtifact.com. We’ll tell you plainly how it works, including what we can’t do yet.