1. Data protection
Encryption in transit
All traffic between users and Anvil is served over HTTPS with TLS 1.3. We enforce HSTS with a 1-year max-age and are preload-listed. Internal service-to-service traffic is encrypted inside our private network.
Encryption at rest
PostgreSQL, MongoDB, Redis persistence, and object storage are all encrypted with AES-256-GCM. Database backups are encrypted with separate keys and stored in a geographically distinct region.
Key management
Data-encryption keys are wrapped by key-encryption keys held in a hardware-backed KMS. Keys rotate on a defined schedule; no human has plaintext access to DEKs.
Secrets
Application secrets are stored in an encrypted secret store, injected at runtime, never committed to source control. Secret scanning runs on every push.
Tenant isolation
Every row in every tenant-bearing table carries a tenant identifier. Authorisation is enforced at the application layer, and cross-tenant regression tests run on each deploy. Storage paths are namespaced.
Data residency
Customer data is primarily hosted in Hong Kong SAR. Enterprise customers can request EU or US-only residency; contact us for pricing.
2. Authentication & access
End-user auth
Email + password, Google OAuth, and SAML/OIDC SSO (Enterprise). Passwords are Argon2id-hashed with per-user salts. Accounts lock after repeated failed attempts.
MFA
TOTP and WebAuthn/passkeys are supported for all plans. MFA is enforced for OWNER and ADMIN roles.
Sessions
Access tokens are short-lived (15 min) JWTs signed with RS256; refresh tokens are rotating and stored in __Host-prefixed HttpOnly cookies. CSRF is mitigated by double-submit tokens and SameSite=Lax cookies.
RBAC
Built-in roles: OWNER, ADMIN, MANAGER, MEMBER, VIEWER. Permissions are enforced server-side; the UI hides what the user cannot do but does not rely on that for security.
Employee access
Engineers have no standing production access. Break-glass access is time-boxed, requires peer approval, and is fully logged. All access uses hardware security keys and a managed zero-trust proxy.
API keys & webhooks
API keys are scoped, revocable, rate-limited, and hashed at rest. Webhooks are signed with an HMAC secret; timestamps and replay protection are included.
3. Infrastructure security
Network
Cloudflare sits at the edge providing DDoS mitigation, WAF, bot management, and TLS termination. Origin is reachable only through authenticated tunnels — the real IP is not publicly routable.
Segmentation
Services are grouped into trust zones. Inter-service traffic uses service-mesh mTLS where available and private networks elsewhere. Databases have no public ingress.
Hardening
Hosts run minimal, regularly patched base images. Container images are built from distroless bases where feasible and scanned for CVEs on every build. Deployments refuse to ship if CRITICAL CVEs are present.
Configuration management
All infrastructure is defined as code. Drift is detected and flagged. Manual changes are the exception and are peer-reviewed.
Supply chain
Dependencies are pinned and reviewed before upgrade. We subscribe to advisory feeds for each language ecosystem and ship upgrades within agreed SLAs based on severity.
Build pipeline
CI runs in ephemeral runners with minimal permissions. Artefacts are signed; deploys verify signatures before rollout.
4. Secure development
- Code review required on every change; no self-merges to production branches.
- SAST, DAST, dependency, secret, and container scanning in CI; findings are triaged and SLA-tracked.
- Threat modelling for new systems that touch auth, payments, or PII.
- Annual third-party penetration test (full-scope). Summary available under NDA.
- Bug bounty / responsible disclosure — see below.
- Security-champion programme: at least one trained champion per squad.
5. Monitoring & detection
- Centralised, tamper-evident log storage with at least 1 year retention for security events.
- Real-time alerting on authentication anomalies, permission escalations, data-export volume spikes, and WAF signals.
- Sentry for application errors; OpenTelemetry traces and metrics for performance.
- Database audit logs for administrative and cross-tenant read/write.
- Weekly review of high-risk audit events by the security team.
6. Incident response
Runbook
Documented procedure with severity tiers, named roles (incident commander, comms lead, scribe), and pre-built communication templates.
24/7 on-call
Rotating engineering on-call. Security incidents page the security lead in addition to engineering on-call.
Notification SLA
Within 48 hours of confirmation of a Personal Data breach, we notify affected customers’ registered security contact per our DPA.
Post-mortems
Material incidents receive a blameless root-cause analysis. Summaries that do not expose other customers are published on the status page.
7. Resilience, backups, and disaster recovery
- Backups: encrypted daily full + hourly incrementals for PostgreSQL; object storage is versioned and cross-region-replicated.
- Retention: 35 days rolling. Legal-hold and longer retention available on Enterprise plans.
- Restore tests: we perform a full database restore to a clean environment at least quarterly and verify data integrity.
- Targets: RPO ≤ 1 hour, RTO ≤ 4 hours for the primary database. Actual measured figures are available to customers under NDA.
- Multi-zone: stateless services run active-active across zones. Stateful services fail over automatically with health-check gating.
8. People & vendors
- Background checks where permitted by law.
- Signed confidentiality and acceptable-use policy on hire.
- Annual security-awareness and phishing-simulation training.
- Managed device posture (disk encryption, screen lock, EDR) required for any device that accesses production.
- Vendor review before engaging any processor with access to customer data. See the sub-processor list.
- Joiner / mover / leaver process for access provisioning and revocation.
9. Compliance & certifications
GDPR & UK GDPR
Controller and Processor obligations, SCCs (Module Two), UK IDTA, DPIA support.
HK PDPO
Data User obligations under Hong Kong’s Personal Data (Privacy) Ordinance — our home jurisdiction.
CCPA / CPRA
Service-provider role, no sale or sharing of personal information, honour GPC signals.
PIPL
Standard-contract route for cross-border transfers out of mainland China on Enterprise plans.
SOC 2 Type II
Observation window opens Q2 2026. Gap assessment complete; remediation in flight.
ISO 27001:2022
Implementation aligned with the 2022 Annex A controls. Stage 1 audit targeted 2027.
Customers on Enterprise plans can request our SIG-Lite, CAIQ, or vendor questionnaire under NDA.
10. Data retention & deletion
- Deletion requests from end-users are honoured within 30 days (or faster where required by law).
- On account termination, data is retained for a 30-day export window, then deleted or anonymised within a further 60 days, per the DPA.
- Backups that contain deleted data are purged on the standard rotation (≤ 35 days). We do not hand-edit backups.
- A certificate of deletion is available on request.
11. Responsible disclosure
We welcome reports from security researchers. Please email security@anvilhk.com (forwarded to 738888@proton.me) with:
- A clear description of the issue and affected asset.
- Proof-of-concept steps, minimised to avoid touching real customer data.
- Your name or handle if you would like credit.
We commit to:
- Acknowledge within 2 business days.
- Provide an initial assessment within 5 business days.
- Not pursue legal action against researchers who act in good faith within the scope of our security.txt policy.
- Credit researchers (with consent) on a hall-of-fame page.
A paid bug-bounty programme is being scoped for 2026. Until it launches, we pay at our discretion for high-impact issues.
12. Status & transparency
- Live status at status.anvilhk.com.
- Scheduled maintenance is announced at least 72 hours in advance on the status page.
- We publish a transparency report annually summarising data-request volumes from law enforcement and government bodies.
13. Contact
- Security reports: security@anvilhk.com
- Privacy & data protection: privacy@anvilhk.com
- Abuse: abuse@anvilhk.com
- Customer support: support@anvilhk.com
All alias addresses currently forward to 738888@proton.me while we complete the corporate mail migration.