Security & trust

How we protect your data

This page describes what protects your data in CutOptim today — measured on the running system, not planned.

Last reviewed: 25 September 2026

What protects your data today

Access & sign-in

You sign in with email and password or with Google. Passwords must be at least 8 characters, are checked against a database of known leaked passwords, and are stored only as bcrypt hashes.
The database enforces row-level security: every request runs as the signed-in user, so an account can read only its own projects, cuts and settings.
A signed-in session ends automatically after 60 minutes of inactivity.
Engine API keys are shown once, stored only as a SHA-256 hash, and can be revoked from the dashboard at any time.
Rate limits protect sign-in, the AI assistant and the public API against abuse.
The admin area requires two-factor sign-in: every admin page and admin API call needs a session confirmed with a one-time code (TOTP).
Administrative changes to customer accounts (plan changes, credits, API access) are recorded in an audit log that nobody — not even our own application — can alter or delete afterwards; an encrypted, hash-chained copy of it leaves the server every day.
Repeated failed sign-in attempts are detected automatically and alert the operator.

Where your data lives

The application and its database run on our own server at Hetzner in Nuremberg, Germany. No third-party database service sits between you and your data.
The optimizer in the app runs in your browser. Your parts list reaches our server only when you save a project — or, for Engine API customers, when you call the API.
Payments are handled by Lemon Squeezy as merchant of record. We never see or store card numbers.
Service providers we rely on: Cloudflare (content delivery and off-site backup storage), Resend (transactional email), Anthropic (the AI assistant — only what you type into the chat) and Google (only if you choose Google sign-in). Website statistics are cookieless (Umami).

Backups & recovery

The database and uploaded files (such as company logos) are backed up every night, and a copy is kept off the server with Cloudflare — a failure of the server cannot take the backups with it.
Daily copies are kept for 14 days and weekly copies for 90 days; older copies are deleted automatically.
Before a copy leaves the server it is encrypted with our own key. The decryption key is not stored on the server, so the off-site copy is unreadable without it. Every upload is checked against the local file.
The off-site copy is written with a dedicated credential that is not stored alongside the application.
Restores are tested, not assumed: on 24 September 2026 a backup was fetched from the off-site store, decrypted and restored into a separate database, and every table we checked matched the live database. We repeat this twice a year.
In addition, our hosting provider keeps machine-level backups of the whole server.
A failed backup run, or a service that becomes unhealthy, alerts the operator immediately.
Operations do not depend on one person: a designated second person has emergency access to everything needed for recovery and follows a written recovery guide.

Infrastructure & application hardening

All traffic is encrypted with TLS. The site sends HSTS (preloaded), a Content-Security-Policy, X-Frame-Options, nosniff, a strict referrer policy and a Permissions-Policy that switches off camera, microphone and location access.
Only the web proxy is reachable from the internet; the database, its admin tools and internal services are not.
Administrative access to the server uses SSH keys, and repeated failed login attempts are blocked automatically.
Services run in containers with every Linux capability dropped and privilege escalation disabled.
Operating-system security updates install automatically every day; our dependencies are audited for known vulnerabilities every week.
Every release passes an automated test gate before it goes live, and is rolled back automatically if the new version fails its health check.
Availability is watched by external monitoring, with alerts.
Before a release goes live it is checked for accidentally committed keys or passwords, and we keep a machine-readable list (SBOM) of the software components in every live version.

Your data, your control

Download all of your data (projects, cuts, settings) as a JSON file from your dashboard at any time.
Delete your account from the dashboard: the account and its projects are removed immediately; backup copies age out within 90 days.
Every marketing email carries a one-click unsubscribe link.
Conversations with the AI assistant on our site, together with the IP address, are deleted automatically after 14 days.
Our web server logs keep IP addresses only in shortened form — the network, not the individual address.

Assessing us as a supplier?

If your organisation has to assess its software suppliers — under NIS2, GDPR or your own security policy — we answer security questionnaires on request. Write to us and tell us what you need. Contact us →

Reporting a vulnerability

Found a security vulnerability in CutOptim? Write to [email protected]. Our machine-readable contact is /.well-known/security.txt (RFC 9116).

What we commit to

Acknowledgement within 3 business days.
No legal action for good-faith research.
Credit on request after the fix.

What we ask

Do not access other users’ data and do not destroy data.
No denial-of-service testing.
Allow reasonable time to fix before public disclosure.

How current this page is

This page describes the system as it stands today, not a roadmap. When something changes, the page is updated — and the review date above changes with it.

Legal & data protection

The formal documents behind this page: