Data & security

The questions a tech lead asks before sending user data to any third party, answered plainly. No claim on this page is aspirational — everything here describes the running system.

What we store

Only what your backend and your users send through the API:

• Users — the id you choose plus an optional custom object. Ids can be fully opaque (u_8f3k…); we never require an email, a name, or any other personal field. If you don’t send PII, we never hold PII.
• Activities, follows, reactions, notifications — verbs, object refs, timestamps, and your custom payloads.

Nothing else is collected. There is no tracking of your end users, no analytics on their behavior, no third-party data enrichment.

Where it lives

• All tenant data is stored in the European Union.
• One database per tenant. Your data is not in shared tables with other tenants — isolation is structural, not a WHERE clause. Every release runs an automated cross-tenant isolation test.
• Encrypted off-site backups (AES-256), continuous, also EU-hosted, restore procedure tested.

Who can authenticate

You are the identity provider — we hold zero user credentials. Your backend mints short-lived, HS256-signed user tokens with your API secret; we only verify them. There are no user passwords, sessions, or refresh tokens on our side to leak. Your API secret is stored encrypted (AES-256-GCM) at rest.

Compromised or departed user? Your backend calls token revocation and every outstanding token for that user dies immediately — durable through restarts.

What our operations can see

• Error tracking receives no request bodies and no user content — only stack traces, a request id, and a route path.
• Logs redact authorization headers, API keys, and secrets before any sink; diagnostics never include your users’ data.

Subprocessors

We keep the vendor list short, all under GDPR-compatible terms:

• Infrastructure hosting — EU data centers
• Backup storage — EU, encrypted before upload
• Error monitoring — receives stack traces only, never user content
• Uptime monitoring — probes public endpoints only, touches no data

The named list ships with the DPA and we notify customers before adding or changing a subprocessor.

Breach notification

If an incident affects your data, we notify you without undue delay with what we know, what’s affected, and what we’re doing — so you can meet your own obligations to your users.

Deletion

• Deleting an activity removes it from every follower’s feed.
• Unfollowing scrubs the follower’s timeline of the unfollowed feed’s items.
• Deleting a tenant deletes the tenant’s database. Backups age out on the retention schedule.
• On contract termination, your data is deleted (or exported first, on request) — nothing is retained beyond the backup retention window.

The honest part

Drop-In is a small, focused service — we’d rather tell you exactly what you’re getting than gesture at enterprise theater:

• No SOC 2 / ISO 27001 certification (yet). What you get instead is a small attack surface by design: one feature, no stored credentials, structural tenant isolation, and a spec-driven codebase where auth lives in exactly one place.
• Uptime and errors are externally monitored around the clock.
• Questions, security reports, or a data-processing agreement for your compliance review: markospavicbg@gmail.com. Security reports get answered first.

Related

• Authentication & tokens — how tokens are minted and revoked, and why we never hold your users’ credentials.
• How it works — per-tenant database isolation.
• Limits — the ceilings that protect a tenant from noisy neighbours.