This page describes how Canton Check protects data today. We'd rather be precise than impressive.
Certifications
- SOC 2 / ISO 27001: not audited yet. Canton Check is an early-stage service operated by LET ME LLC. We will pursue an independent audit once customer demand requires it.
- Security questionnaire: we are happy to complete your security or vendor questionnaire. Request it through /contact (request type "Security questionnaire").
- Data Processing Agreement: our standard DPA is published at /dpa.
Infrastructure
| Layer | Provider |
|---|---|
| Application hosting and deployment | Lovable |
| Database and authentication | Supabase (database region: Ireland (AWS eu-west-1)) |
| Network delivery and security | Cloudflare |
| Data collection from sources | Apify |
| Machine translation and name suggestions | AI models via the Lovable AI gateway |
These providers run their own security programmes and publish their own certifications.
How we protect data
- Encryption in transit: all traffic uses HTTPS/TLS.
- Database access rules:
- row-level security is enabled;
- internal tables are reachable only from our server code, never from the browser. These are the registry cache, data-source logs, messages, report-unlock records and search-suggestion cache.
- Report access control: full reports are served only to the person who ran the check, an administrator, or a visitor who unlocked that report with their own allowance. Report IDs alone grant nothing.
- Minimal personal data:
- IP addresses are stored only as one-way hashes, used to enforce free limits;
- API keys are stored only as hashes and shown once at creation;
- passwords are handled by our authentication provider and never stored in plain text.
- Admin access: administrator rights are checked on the server against a roles table; they are never trusted from the browser.
- Abuse prevention: rate limits and quotas on searches, checks and forms (see /acceptable-use).
- Monitoring: every call to a data source is logged with outcome, duration and cost, without user personal data. Live component health is public at /status.
- Analytics only with consent: Microsoft Clarity loads only after a visitor accepts analytics.
Responsible disclosure
If you believe you've found a security vulnerability, please report it through /contact (request type "Security report"). Include steps to reproduce. Please don't access other users' data, degrade the Service or publicly disclose the issue before we've had a reasonable chance to fix it. We won't take legal action against good-faith research that follows these rules.
Related
- Privacy Policy: /privacy
- Data sources and how we obtain them: /data-sources
- Service levels: /sla
- Live status: /status