How we keep your API and your data

What we do

• The site, the APIs, hosted references, docs and MCP servers run as one Cloudflare Worker.
• Workspace data is in one Cloudflare D1 database; versions of your OpenAPI document and docs bundles are in one private R2 bucket.
• Hosted references and docs load no third-party script or font, and each response sends its own content security policy. Our own pages report errors to Sentry, with identifiers removed first.
• Your API credential for hosted MCP is sealed with AES-GCM 256 under a Worker secret, with a fresh IV each time, and one module decrypts it.
• CI keys and MCP keys are stored only as SHA-256 hashes, and shown once.
• MCP sign-in tokens are bound to one server and never sent to your API.
• The API client’s proxy (Pro) calls only hosts you verified, follows no redirects and stores nothing.
• Fixes to your spec are rules-only JSON Patch: no workspace feature sends your spec to an AI model. The paid readiness report on our public site does, outside the workspace.
• Sign-in is with GitHub or an emailed link that works once, for 15 minutes. SSO is OpenID Connect, on Business and Enterprise.
• The audit log is append-only: the database refuses changes, and deletes of events younger than 30 days. It's kept 90 days on Business and 365 on Enterprise.
• Each project keeps its last 10 versions on Free, 200 on Pro and 1,000 on Business. After a downgrade, the old plan's number holds for 30 days.
• Deleting a project, a workspace or your account deletes it at once; database backups keep it for up to 30 more days.
• The SDK runtime, the agent-readiness rules and the CI Action are public, and request collections export to Postman.
• Uptime is published on our status page, and the SLA covers Enterprise.
• Every response is sent with MIME sniffing off, a strict referrer policy, browser features such as the camera turned off, and no framing by other sites unless a page is meant to be embedded; on our own domains, browsers are also told to use only HTTPS.
• Our tests, which run before every automated deploy, scan our code for live keys and tokens, and a match stops the deploy.
• We have no SOC 2 or ISO 27001 report and no third-party penetration test yet.
• Database backups are D1 Time Travel: we can restore the database to any minute in the last 30 days. Stored files (R2) have no versioning.
• Your data is stored in the United States: the database on Cloudflare D1 under its US jurisdiction, and files on Cloudflare R2 in Eastern North America.
• One person, the founder, has production access.
• A data processing agreement is available to Enterprise customers on request.
• No workspace feature calls an AI model: fixes, SDKs, docs and MCP servers are built by rules. The one model call is the site’s support chat, which sees only what you type into it.
• Vulnerability reports go to the address below.

Who processes data for us

• Cloudflare, Inc.: Hosting, content delivery and security; storage of orders, the dashboard, the CRM and sandbox sessions (United States, with a global network)
• Stripe: Card payments, fraud prevention and invoicing (United States and Ireland)
• Resend: Sending emails: download links, sign-in links, contact form messages (United States)
• GitHub, Inc.: Signing in to the workspace with GitHub, if you choose to (your GitHub id, login, name and verified email) (United States)
• Anthropic, PBC: Writing the support chat’s answers (the Claude API) (United States)
• Functional Software, Inc. (Sentry): Error reports from our servers and our own pages, with identifiers removed first (United States)
• Better Stack, Inc.: Checking every few minutes that our public pages answer; it receives no personal data (United States)

How do I report a vulnerability?

Write to info@latitude10.tech. Please give us time to fix it before you disclose it. Uptime and incidents are on our status page.