We protect the product data entrusted to DPPora.
DPPora combines managed European infrastructure, controlled access and independently stored encrypted backups. This page explains what is implemented today, what has been recovery-tested and where our current assurance limits are.
European hosting with separated recovery storage
DPPora uses specialist managed providers rather than operating an undocumented private server stack.
The DPPora web application runs on Cloudflare infrastructure.
Core data services run in the Frankfurt EU region.
Encrypted recovery archives are stored separately from Supabase.
Practical controls around private business data
Private workspaces
Account, organisation and unpublished product data are accessed through authenticated application workflows. Public access is limited to information intentionally published through public passport pages.
Controlled backend access
Privileged Supabase credentials are restricted to server-side services and protected secret stores. They are not embedded in public browser code or committed to the source repository.
Transport protection
DPPora is delivered over HTTPS. Data transmitted between users, the application and managed infrastructure is protected using TLS in transit.
Database and Storage controls
Supabase provides the production PostgreSQL database, authentication and object storage in the EU. Database and Storage authorization policies separate private workspace data from published passport information.
A backup is only credible when it can be restored.
Our automated recovery system protects both structured records and the images, PDFs and evidence files those records reference.
- The PostgreSQL database and every Supabase Storage object are backed up automatically each day.
- Backups are compressed and encrypted with age public-key encryption before upload to a private Cloudflare R2 bucket in the EU jurisdiction.
- The private decryption identity is not stored in GitHub, Cloudflare R2 or the production application.
- Encrypted archives have SHA-256 checksum files and are retained for 35 days.
128,250,856 bytes were restored into an isolated Supabase project. Every restored object was downloaded again and matched its original SHA-256 checksum.
- Database
- Restored
- Storage objects
- Restored
- Checksum result
- All matched
Current assurance position
Independent certification
DPPora is not currently certified to ISO/IEC 27001 and has not completed a SOC 2 examination. We do not present internal controls or provider certifications as if they were DPPora certifications.
Scope of recovery
Daily recovery covers the logical database, authentication records, Storage metadata and uploaded Storage files. Application source is version-controlled in GitHub. Provider-only configuration remains documented operationally rather than included in the daily data archive.
No absolute guarantee
No internet service can guarantee absolute security. We review controls as the platform changes and disclose the current position without claiming that risk has been eliminated.
Found a potential vulnerability?
Please report security concerns privately. Do not include customer information, credentials or personal data in a public issue.