Scope and reporting
This page supports Redomon’s global B2B SaaS. The operator is based in Argentina; the service is not limited to the Argentine market. Applicable privacy and other mandatory laws depend on the relevant processing and jurisdiction.
Redomon is operated by Manuel García Nicastro, CUIT 20-50046009-2, La Plata, Argentina. Report security concerns privately to hello@redomon.com with enough detail to reproduce the issue, without exposing other customers’ data. Do not send passwords or live secrets. No paid bounty or permission to test third-party infrastructure is implied.
Platform and access requirements
Redomon uses Cloudflare-hosted services, Neon PostgreSQL and Clerk authentication and organizations. Polar handles paid purchases as merchant of record; Redomon does not collect full card details in its interface. Our security requirements include authenticated organization context, server-side workspace and product permissions, restricted browser origins, request-size controls and signed billing-webhook validation. These controls do not eliminate every risk.
Mail, AI and analytics
Mailbox access credentials or tokens must be encrypted, access-restricted and excluded from application output and logs. IMAP and SMTP connections require protected transport and authorized mailbox access. AI processing is subject to the DPA’s provider disclosure, written-contract and verified zero-retention requirements. Analytics access and CRM-contact linking must respect workspace permissions; event properties and uploaded documents or files must not bypass sensitive-data restrictions.
Processing locations
Primary database storage and application Workers are hosted in Frankfurt, Germany. This is a service-region commitment, not a guarantee that all processing occurs in the EU. Cloudflare edge delivery, provider operations and support, customer-selected mailbox services, separately disclosed AI processing and necessary operator access from Argentina may involve other countries. Object storage, backup and onward-processing locations are governed by the disclosed provider configuration and applicable transfer safeguards; no EU-only processing or Frankfurt object-storage guarantee is made.
Security and deletion obligations
Our DPA sets requirements for access control, encrypted transport and provider-supported encryption at rest, confidentiality, secret management, proportionate logging, recovery, incident response, export and deletion. Active-system deletion and restricted backup expiry follow the privacy notice and DPA, including shorter applicable rights deadlines. This overview does not claim SOC 2 or ISO certification, an independent penetration test, end-to-end encryption, a particular encryption algorithm or a recovery objective.
Incident notification
If we become aware of a personal data breach affecting customer data, we notify the customer without undue delay, provide the information then available and supplement it as facts develop, as described in the DPA. An incomplete investigation does not delay initial notice. This is not a promise that every incident is detected within a fixed number of hours.
Customer responsibilities and availability
Use strong account security, review organization membership and roles, minimize synchronized data, and keep independent copies of important records. No system is risk-free. No contractual uptime SLA or service credit applies unless separately agreed, and Starter includes no SLA. Contact us for a current security description or a security question about your workspace.