Trust & Safety
Where your data lives, and how it's protected.
One page for security reviews: our EU-only infrastructure, the encryption and isolation model, what we store (and what we never do), and where our compliance work stands - including what we're still working on.
- EU data residency
- Encryption at rest
- SHA-256-hashed API keys
- Passkeys (WebAuthn)
- Entra ID SSO
- SCIM 2.0
- Audit logging
- Per-key rate limiting
Security
The controls in this section are implemented in the platform today.
Encryption at rest
Database credentials are encrypted at rest with the .NET Data Protection API. API keys are never stored in plaintext - only their SHA-256 hash. Traffic between your clients and your API is served over TLS.
Data-plane authentication
Your API authenticates requests with API keys, JWTs, or mTLS - per your configuration. Keys are organization-scoped and can be rotated or revoked at any time.
Tenant isolation & RBAC
Every query is scoped to your organization, enforced by a single global filter - not a per-handler convention. Role-based access control uses built-in organization roles and API key roles. Each API runs in its own container.
Audit logging
Administrative actions and API requests are recorded in an audit trail you can inspect in the dashboard.
Per-key rate limiting
Rate limits are applied per API key, distributed across the fleet.
Over-limit requests get a 429 with
a Retry-After header - nothing is
silently dropped.
Secret hygiene
API keys are shown once at creation. Secrets never appear in logs, and all database access uses parameterized queries.
Compliance
EU data residency
All RestWard infrastructure runs in the EU - on Hetzner in Helsinki, Finland. Your database credentials stay in the EU. We deliberately do not claim that "no data leaves the EU" in general: the subprocessors below (payments, email) are US-based and see only what their function requires - never your database contents or credentials.
Subprocessor transparency
| Subprocessor | Location | Processes |
|---|---|---|
| Hetzner | EU (Helsinki, Finland) | Hosting - all platform infrastructure |
| Stripe | US | Payment processing only |
| Resend | US | Transactional email (recipient address and message text - verification, reset, invitation; never your database contents) |
| Microsoft Entra ID | Your tenant's region | Your own identity provider, not our subprocessor. Used only if your org enables Entra ID SSO (OIDC); we receive sign-in claims (tenant, object id, email, name), never passwords |
GDPR
Designed forThe architecture is built for GDPR: EU data residency, encrypted credentials, defined retention, and a DPA available on request. We hold no security certifications (such as SOC 2 or ISO 27001). We are not presenting an audited compliance certification - we are presenting the design and the contact for the paperwork.
Infrastructure
EU-only hosting
Every layer of RestWard - control plane, databases, and the containers that serve your APIs - runs on Hetzner in Helsinki, Finland.
Multi-tenant isolation
Organizations are isolated at the data layer (every query org-scoped) and at the runtime layer (each generated API runs in its own Docker container on our Hetzner hosts).
Where your data flows
RestWard generates an API around your database. It proxies requests to your
database and returns the response; rows are not stored by RestWard. The one exception is
an optional per-endpoint response cache for GET requests: off by default,
held in memory only for the TTL you set, and never written to disk.
Your database
Wherever you run it · credentials encrypted at rest with us
RestWard · EU (Helsinki, FI)
Schema, config, keys (hashed), audit logs
Your API · EU
Own container · keys + RBAC + rate limits enforced
Privacy
What we store
- Organization and membership records
- API keys - SHA-256 hash only
- Database connection metadata - credentials encrypted
- Audit log entries
- Billing records (held by Stripe)
What we never store
- Rows from your database - requests are proxied, not stored (optional in-memory response cache, off by default)
- Plaintext API keys - shown once, then hashed
- Unencrypted database credentials
- Request bodies - rate limiting and audit do not retain payloads
Retention
- API request audit: 90 days, all plans
- Security events (logins, key and role changes): kept for the life of the organization
- Your data: not stored, except the optional in-memory response cache, which lasts the TTL you set
- Account deletion: request via the contact below
- Invoices and payment records: kept for 5 years from the end of the financial year they relate to, as required by Danish bookkeeping law; everything else is erased 30 days after a deletion request
Data subject rights (access, correction, erasure) are handled on request - Privacy Policy and Terms cover the details.
Report a vulnerability
If you believe you've found a security issue in RestWard, report it privately to security@restward.tech. Please give us a chance to investigate and respond before any public disclosure. There is no public bug bounty program at this time.
Contact the team