Security at ēvehit

ēvehit's application, database and scheduled jobs run in Railway's EU West region in Amsterdam, the Netherlands. The background process that carries out whole-workspace deletion runs in Railway's US West region.

Document files you upload are stored with Cloudflare and are not restricted to the EU. Some of our providers process data outside the European Economic Area (EEA), mainly in the United States.

The privacy notice lists the providers we use to run ēvehit, what each one does, and where each one processes data.

Each workspace is kept separate from every other workspace in the database. The database enforces this separation itself, using row-level security.

Connections to ēvehit use HTTPS, and ēvehit tells browsers to connect to it only over HTTPS.

You sign in with a single-use link sent to your email address, or with Google. There is no ēvehit password. Sign-in attempts are rate-limited.

You can see the devices you are signed in on, and sign them out, in Settings → Account.

Railway keeps point-in-time recovery copies of the database for its configured retention period. We also make manual backups, which we keep outside Railway and delete 90 days after each one is made; they leave out sign-in records and the credentials for Google and connected apps. Data deleted from ēvehit can remain in these copies until the end of those periods.

Please report security issues to security@evehit.com. We will not take action against anyone who reports a vulnerability to us in good faith and does not misuse it.

If you think someone else has used your ēvehit account, tell us at once at security@evehit.com.