Security and data protection

Every record carries a tenant identifier, and isolation is enforced in the database itself through row-level security policies rather than only in application code. A query that omits the tenant context returns nothing rather than returning everything.

This matters because application-layer isolation fails open: one missing WHERE clause in one endpoint exposes another account's data, and that endpoint may be written months after the pattern was established. A database policy fails closed instead, so the same mistake returns an empty result rather than a breach.

Data is encrypted in transit using TLS, and at rest using the storage-layer encryption provided by our infrastructure provider. Credentials and API keys are stored hashed or encrypted rather than in plain text.

We describe this plainly rather than as 'bank-level' or 'military-grade', because those phrases describe no specific control. What matters to an assessor is which algorithm, which key management, and who can access the keys — and those are questions we answer directly on request.

Data for this website, including waitlist signups, is stored in Amazon Web Services in the eu-north-1 region, located in Stockholm, Sweden. Personal data collected here therefore remains within the European Union.

Moosewave is operated by Horizonfold Labs LLP, an Indian entity. India's Digital Personal Data Protection Act 2023 permits transfer to countries not on a government blocklist, and the European Union is not restricted. For EU data subjects, storage within the EU avoids a cross-border transfer entirely.

Access to production infrastructure is limited to the engineers who require it, authenticated through the cloud provider's identity system with multi-factor authentication required. Infrastructure is defined as code and changes are made through that definition rather than by console clicking, so the change history is reviewable.

We are a small team, and we will not describe our access model as more elaborate than it is. There is no separate security operations function; the people who build the system are the people who operate it.

Dependencies are scanned for known vulnerabilities as part of the build, and we track advisories affecting the languages and runtimes we use. Reports from outside are welcome at the address below and we will acknowledge them.

We do not currently run a paid bug bounty programme, and we would rather say so than imply a level of formality we have not reached.