Security

1. Encryption

• In transit: the website, the web app, and the API are served over HTTPS only. The desktop app, CLI, and editor extensions talk to the API over HTTPS too.
• Secrets at rest: secret environment variables, auth settings on requests, folders, and collections (bearer tokens, passwords, API keys, OAuth tokens), share-link tokens, and integration tokens are encrypted with AES-256-GCM before they reach the database. The key is kept outside the database.
• Passwords are stored only as bcrypt hashes. Authenticator-app (TOTP) secrets are encrypted at rest.
• Backups are encrypted at rest by the storage provider.

2. Hosting and data location

Requestarium Cloud runs on servers of Hetzner Online GmbH in Nuremberg, Germany. Your account and workspace data are stored in the European Union. Our company is in Poland, so the data is handled under EU law and the GDPR.

• The servers talk to each other only over a private network. From the internet, only the load balancer accepts traffic, on ports 80 and 443.
• Server and cluster administration (SSH, Kubernetes API) is reachable only from a short allowlist of IP addresses.
• Operating system security patches are installed automatically.
• The database runs as two instances, a primary and a replica, so a single server failure does not lose data.

Cloudflare provides DNS and network protection in front of the service. The full list of providers that process data for us is on the DPA and subprocessors page.

3. Backups and recovery

• The database is backed up continuously (write-ahead log archiving) and in full once a day.
• Backups are kept for 14 days, and we can restore the database to any point in time within that window.
• Backups are stored in a separate provider (Cloudflare R2), outside the servers that run the service.
• Data you delete from your account is gone from backups once they age out, at most 14 days later.

4. Accounts and access

• New email accounts confirm their address with a one-time code before the first sign-in.
• Two-factor authentication with an authenticator app is available to every user, with one-time recovery codes.
• You can sign in with Google instead of a password.
• Organizations control who sees what with roles and workspace-level permissions.
• Only the founder has administrative access to production. We access customer data only to provide support you ask for, or when the law requires it.

5. What never reaches our servers

• Card details. Payments are handled by Paddle, our Merchant of Record. We never see or store card numbers.
• AI prompts. The AI assistant uses your own model key and calls the provider you choose directly from your app.
• Your API traffic. Requests you send from the desktop app, CLI, or editor extensions go straight from your machine to the API you are testing, not through Requestarium.
• Local data. Collections you keep only in the desktop app stay on your device.

6. Self-hosted: keep everything inside your network

If your security team does not allow a third-party cloud, run Requestarium on your own server. The self-hosted server is the same product: web app, desktop sync, CLI, MCP server, and editor extensions all connect to it.

• Your data stays on your infrastructure. We have no access to it.
• The server never calls Requestarium or Paddle. The licence is a signed file checked offline, so it works in air-gapped networks.
• You choose the network, the backup policy, single sign-on at the proxy, and who can reach it.
• Because no customer data reaches us, most vendor-review questions about our hosting no longer apply.

See the self-hosted guide or contact us for a licence.

7. GDPR and compliance

We process personal data under the GDPR. Business customers can rely on our Data Processing Agreement, which also lists every subprocessor. How we handle personal data is described in the Privacy Policy.

Requestarium is a small company and does not hold SOC 2 or ISO 27001 certification yet. If your review needs more detail, email [email protected] and we will answer your security questionnaire.

8. Incidents

If a security incident affects your data, we will tell the affected customers without undue delay, with what happened, what data is involved, and what we are doing about it. For personal data, we notify business customers in time for them to meet their own 72-hour reporting duty under the GDPR. Service status is published at status.requestarium.com.

9. Report a vulnerability

If you find a security issue in Requestarium, email [email protected]. Please include the steps to reproduce it, what an attacker could do, and the affected URL, app version, or component.

• We confirm we received your report within 3 business days, and keep you updated until it is fixed.
• Please give us 90 days to fix the issue before you publish it. We are happy to credit you, if you want.
• We will not take legal action against research done in good faith: test only your own accounts and data, stop and tell us if you reach someone else's data, and do not degrade the service for others.
• Out of scope: denial-of-service and load testing, social engineering, spam, and reports from automated scanners without a working impact.
• We do not run a paid bug bounty yet.

Our contact is also published in security.txt.