Security at Belvador

Where your data lives

• Events, stack traces, breadcrumbs, traces and logs are stored on a node inside your own Hetzner project. They are never stored in Belvador's control plane.
• If your node is unreachable, Cloudflare holds incoming errors for up to 14 days, and traces and logs for a few minutes, sealed with your node's key so that Belvador cannot read them.
• Belvador's control plane keeps accounts, settings, hourly counts, uptime check results and error titles with personal data removed.
• Your node removes personal data such as emails, IP addresses and tokens before anything is written or leaves the node.

How your Hetzner token is kept

• Your browser sends the token straight to a separate vault. The web app and its database never see the token or its encrypted form.
• The vault can only perform a short list of operations on servers labelled as managed by Belvador, with rate limits, an emergency freeze and an audit entry for every use.
• Two custody modes: Managed keeps the encrypted token so Belvador can maintain your node; Strict deletes it right after setup and asks for a temporary token when needed.

Accounts and access

• Two-factor authentication is required for owners and admins before sensitive actions, and every sensitive action needs a fresh code.
• Belvador staff cannot see your errors, events, traces or logs: they stay on your node, and no staff role can open it. Staff see account metadata only — names, versions, counts and health. If you turn on support access, they can also see your monitor, uptime and alert settings, never secret values.
• Security-relevant actions go to an append-only, hash-chained audit log that is anchored outside the database every day.

If something goes wrong

If a security incident affects your data, we will tell you within 72 hours of confirming it, with what happened and what we are doing.

Service providers

• Cloudflare — receives errors, traces and logs at the edge, holds the sealed buffer and encrypted backups, and judges uptime checks and ping URLs.
• Supabase — stores accounts and settings for the control plane.
• Lovable — hosts the Belvador web app.
• Hetzner — runs your node under your own contract with them, and Belvador's uptime probes under Belvador's.

Sub-processors · Data processing agreement (draft)