Hosted in the EU
Database in Frankfurt
Postgres on Supabase in the EU, reached through Cloudflare Hyperdrive.
Media in the EU
Files are stored in Cloudflare R2 with EU jurisdiction.
Served from the edge
Pages and API responses come from Cloudflare Workers, close to each visitor.
Managed backups
The database runs on Supabase’s managed Postgres, with its backups.
Encrypted in transit
Every connection uses HTTPS, and the API sends strict security headers.
Deletion that means it
Deleted files go for good after 30 days, a deleted form submission takes its webhook copies with it, and a deleted client is purged from the database, storage and caches 30 days later.
Two walls
between clients
Every table with client data carries the client’s id. The API filters on it in every query, and Postgres row-level security checks it again, with a runtime role that can’t bypass it.
Row-level security
Without a client context, the database shows nothing at all.
An audit log that only grows
Changes are recorded in a log the API can’t edit or delete.
Agency changes are marked
When agency staff change something, the audit log says so.
Access that stays
where it belongs
Two-factor sign-in
Authenticator apps with backup codes. Required for agency staff, available to everyone.
Safe password resets
When two-factor is on, a password reset asks for the second factor too.
Keys kept as hashes
API keys are stored as an HMAC and shown once. Revoking one stops it at once.
Scopes and domains
Secret keys get only the scopes they need; publishable keys work only from your domains.
Signed webhooks
Each delivery carries an HMAC-SHA256 signature and a timestamp; old messages are rejected.
Rate limits
Sign-in, analytics collection and forms are rate limited to keep abuse out.
Analytics that respect
your visitors
No cookies
t.js stores nothing in the browser.
No IP addresses kept
A visitor is a hash of the day’s salt, IP and browser; the salt is deleted when the day ends.
Signals respected
Do Not Track and Global Privacy Control turn collection off.
Your data, on your own
Anyone can download their data as JSON and CSV, or close their account, from Account and privacy.
Visitor requests, handled
Owners find, export and delete a visitor’s form submissions by email address, across every site.
Photos without location
GPS, camera and date metadata (EXIF, XMP, IPTC) are removed from images on upload.
AI only when you say so
AI features stay off until an owner turns them on. Until then, nothing leaves Manifolio.
Who to write to
Personal data: privacy@manifolio.com. Authorities (DSA art. 11): authorities@manifolio.com. Everything else: hello@manifolio.com.
Found a vulnerability?
Tell us first
Write to security@manifolio.com with the steps to reproduce it and the impact you see. We confirm receipt and keep you posted until it’s fixed.
In scope
app.manifolio.com, api.manifolio.com, manifolio.com, the t.js and bridge.js scripts and @manifolio/sdk.
Out of scope
Our customers’ own sites, the services of our providers, social engineering, physical attacks and scanner reports without a demonstrated impact.
Test safely
Use your own accounts and test data. Don’t access, change or delete other people’s data, and stop as soon as you reach it. No denial of service or load testing.
Safe harbor
Research done in good faith under these rules is welcome: we won’t take legal action or file a complaint against you for it.
90-day disclosure
Give us 90 days from your report before you publish details, or less once a fix is out. We agree the date with you.
Credit
With your permission, we name you in the changelog entry for the fix.
Report a vulnerability
security@manifolio.com reaches the people who fix it. Please don’t include other people’s personal data in the report.