Legal
Security
Last updated: 7 July 2026
1. Infrastructure
Roastnet runs on Amazon Web Services in the London (eu-west-2) region, behind load balancers with health-checked, auto-scaling application servers. Deployments are zero-downtime blue/green releases. Static assets are served through a global CDN.
2. Data isolation
Every customer workspace has its own isolated database. There is no shared business-data store between workspaces, which structurally prevents cross-tenant data access.
3. Encryption
All traffic is encrypted in transit with TLS. Data is encrypted at rest on managed storage, and stored credentials and API keys are encrypted at the application layer before they reach the database.
4. Payments
Card data never touches Roastnet servers. Payments are processed by Stripe (PCI DSS Level 1); storefront payments settle directly into the roastery's own Stripe account. Incoming payment webhooks are verified with per-endpoint signing secrets.
5. Access control
Workspace access is role-based, with granular permissions enforced server-side on every request — including requests made by AI agents, which run under the invoking user's permissions. Two-factor authentication (TOTP) is available for logins and for step-up approval of sensitive actions.
6. Backups and continuity
Databases are backed up automatically on a rolling schedule, and infrastructure is defined so that services can be rebuilt from configuration. Immutable, versioned asset storage prevents deployment-time corruption.
7. Development practices
Changes ship through code review, automated test suites and staged deployment. Secrets are held in managed secret stores, never in source control, with automated scanning to enforce this.
8. Responsible disclosure
If you believe you have found a vulnerability, email [email protected] with details and steps to reproduce. We acknowledge reports promptly, keep you informed while we investigate, and do not pursue good-faith research conducted within the law.
Questions about these documents? Contact the team.