Security
Last updated: 17 August 2026.
This page describes the measures actually in place. Where something is missing, it says so — we would rather you heard it from us.
Access and identity
Passwords and sessions
Passwords are stored as bcrypt hashes; the system never holds them in clear at any point. The session travels in a signed token inside an httpOnly cookie — not in localStorage, where a third-party script could read it.
Second factor
TOTP two-factor authentication (RFC 6238), enabled per user. An administrator can make it mandatory for their organisation.
Authorisation
Every role carries an explicit set of permissions, checked on each request. Reads are confined to the caller's organisation by the server, not by the interface: a request for another organisation's data does not get a cosmetic refusal — it gets an empty result, or a 404 that does not even confirm the record exists.
Isolation and network
Traffic between nodes
Cluster nodes communicate over an encrypted VPN, and the workload network is bound to that VPN rather than to the public interface. Inter-node traffic never crosses the provider network in clear.
Running on your own infrastructure
On request, your jobs can run on your own machines — ephemeral ones, created and destroyed with each execution — or on a dedicated cluster. In that case compute and storage stay inside the perimeter you choose.
Third-party extensions
Packages uploaded to the marketplace are scanned with ClamAV and Trivy before they can be approved. The rule is that a missing scanner does not count as a pass: if the scan cannot run, the package is recorded as unverified and is not approvable.
Data
Where it lives
The core infrastructure is in the European Union (Germany, Finland, Austria). Some optional features — language models, fine-tuning, document indexing — involve processing in the United States, and each is listed on the sub-processors page. If you do not enable them, those providers process none of your data.
Backups
The database is copied automatically every two hours. Copies are kept for 24 hours and live on the same infrastructure: they cover recent operational error, not loss of the site. Longer retention and an off-site copy are planned and not yet in place.
Secrets and credentials
Customer cloud credentials and provider tokens are stored encrypted and are never returned in clear by any read interface.
What we do not have
No formal certification: we are neither ISO 27001 nor SOC 2, and no third-party audit is under way. There is no enterprise single sign-on yet, and no public status page. Backups, as noted above, cover 24 hours.
If any of these is a requirement for your organisation, tell us before signing: we can say what is planned and when — or that it isn't.
Reporting a problem
If you have found a vulnerability, write to security@webrobot.eu. We reply within three working days. We take no legal action against anyone who reports in good faith, stays within their own data, and gives us time to fix before disclosing.