Security
Last updated 20 October 2026
What we do to keep your account, your keys and the people who look at your maps safe. The binding version is section 5 of the data processing agreement, and this page never promises more than it does. Questions, or something to report: [email protected].
Where your data lives
The API and the database run on Hetzner servers in the EU (Germany and Finland), and the tile server on a Contabo server in Germany. Cloudflare sits in front of them for TLS, caching and a web application firewall that checks a vector tile request's token; map tiles on a plan without the worldwide cache may come straight from our tile server, which checks the token itself. Static images and raster tiles carry a key instead, which our own servers check on every request. Paid plans are sold by Paddle, our merchant of record, so card details never reach our servers.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Edge network, cache, DNS, TLS and web application firewall in front of the tile host and the app; the bot check on the sign-in form (Turnstile); storage (R2) for uploaded data layers and icons and for landmark photos | Global edge |
| Paddle.com Market Ltd | Merchant of record for paid plans: checkout, invoices, VAT, refunds | UK / EU |
| Hetzner Online GmbH | Servers running the API, the database and the map renderer, and the entry point of the tile host | EU (Germany / Finland) |
| Contabo GmbH | Server running the tile host: map tiles, fonts and icons | Germany (EU) |
| OVH SAS (OVHcloud Object Storage) | Storage for files attached to support messages | Germany (EU) |
| BunnyWay d.o.o. (bunny.net) | Edge network and cache in front of the tile host for map tiles, fonts and icons, where we choose to use it. Not in use at present | Slovenia (EU); edge locations worldwide |
| Scaleway SAS (Transactional Email) | Transactional email: sign-in codes, workspace invitations, support replies and usage notices | France (EU) |
| Slack Technologies, LLC | Notices to our own team: new accounts, support tickets and usage warnings, with email addresses shortened to their first letter and domain | United States |
The people who look at your maps
- A map on your site asks us for a short-lived token, then fetches tiles with it. We count the token; we do not store which tiles anyone looked at.
- Our Leaflet and OpenLayers plugins use a token in the same way. Raster tiles requested with your key in the address (for QGIS and map plugins that only take a URL) are counted as they are served, fifty to a load; again only the count is kept.
- Request logs are kept for at most 30 days, and rate-limit counters are stored under a keyed hash of the IP address, never the address itself, and expire within a day.
- The SDK and the embed keep the token in memory and set no cookies of their own, and the tile host sets none either.
Your account
- You sign in with a one-time code sent to your email, so there is no password to leak. The code is never stored, only a keyed hash of it; it lives ten minutes, and five wrong guesses burn it.
- Before a code is sent, a bot check (Cloudflare Turnstile) makes sure a person is asking. New accounts are limited per connection and per email domain, and wrong codes per mailbox.
- “Sign out everywhere” ends every session at once.
- Workspaces have owner, admin and member roles, and only the owner creates or revokes keys. Business plans get an audit log of who changed what.
Keys and tokens
- Secret keys (
sk_) are stored only as hashes and shown once; a secret key sent from a browser is refused. - Publishable keys (
pk_) only work from the sites or apps you list. - Tile tokens are signed and live thirty minutes (a map link's, for apps that cannot renew one, a day); a forged or expired one is refused.
- A static image or raster tile URL carries a publishable key, checked against the key's allowed sites on every request.
- Account API keys for your servers and assistants are scoped, stored as hashes and revocable. Assistants connect with OAuth 2.1 and PKCE, and you can disconnect them at any time.
How we build and run it
- TLS on every connection.
- Server secrets are encrypted and kept out of the code and the database.
- The API runs in a minimal container image as a non-root user. Container images are scanned for known vulnerabilities before they deploy, every change to the app gets an automated web security scan, and dependencies are audited before a release.
- Public endpoints are rate-limited per key and per address.
- Production is reachable by the operator only over a private network, and every administrative action is logged.
- The database is backed up, encrypted, within the EU, away from the server it runs on.
If something goes wrong
If a breach affects personal data we hold for you, we tell you without undue delay and within 48 hours of becoming aware of it, as the DPA sets out. The status page shows the health of every part of the service, checked every minute.
Report a vulnerability
Email [email protected] with what you found, how to reproduce it and what it affects. Please give us the chance to fix it before telling others, touch no one else's data beyond what shows the problem, and do not degrade the service for others. Good-faith reports are welcome, and we will tell you what we do about yours.
Machine-readable contact: /.well-known/security.txt.