# Security and data handling

> Redactly processes documents that contain personal data, so the security model is deliberately small: text is redacted in memory, responses are returned synchronously, and request bodies are not written to storage.

Canonical: https://bitbanger.in/security
Last updated: 2026-10-26

## How your data is handled

- **In memory only.** Request bodies are redacted in the running process and returned in the response. Redactly does not persist submitted text or files.
- **No training on customer data.** Documents you send are not used to fine-tune or otherwise train the detection model.
- **API keys are hashed.** Keys are generated with 192 bits of randomness, prefixed `rdct_`, shown once, and stored only as a SHA-256 hash. Revoking a key takes effect immediately.
- **Output is irreversible.** Replaced, masked, and removed spans cannot be recovered from the redacted output. If you need reversibility, keep the original in your own system.

## Transport and infrastructure

- The marketing site is served by Cloudflare Pages with HSTS enabled, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, and a restrictive Content Security Policy.
- All traffic is served over HTTPS. Plain HTTP requests are redirected to HTTPS with a 301.
- The API runs as a container behind an HTTPS proxy with a health check and automatic restart on failure.
- The API only accepts cross-origin browser requests from the Redactly domains. Other origins are rejected by CORS.

## Compliance frameworks

Redactly is designed for teams operating under GDPR, HIPAA, and CCPA, and maps its controls to SOC 2 and ISO 27001.

- **GDPR** — data minimisation by design: only the text you submit is processed, and nothing is retained.
- **HIPAA** — redaction of the 18 identifier categories before data reaches analytics or downstream systems.
- **CCPA** — removal of personal information from datasets before sharing or export.

Enterprise plans include a Data Processing Agreement and a configurable retention policy. Ask for the current security documentation before your procurement review.

## Responsible disclosure

If you believe you have found a vulnerability, email albie.dev422@gmail.com with steps to reproduce. Please do not open a public issue or test against data that is not yours. Reports are acknowledged within two business days.

## Contact

- Email: albie.dev422@gmail.com
- Phone: +91 94074 59327

## Related

- [Home](https://bitbanger.in/)
- [API reference](https://bitbanger.in/docs)
- [Privacy policy](https://bitbanger.in/privacy)
- [Terms of service](https://bitbanger.in/terms)