RAXARDel Caos al Éxito
Loading ecosystem
Loading ecosystem
Security and Compliance
RAXAR does not improvise security. We apply verifiable technical controls from day one — the same ones we use in our own operation. Servers in the EU (Hostinger · datacenter with ISO 27001 certification according to the provider). No corporate certifications of our own yet; the roadmap below says so plainly.
Living document · last review: S392 · 2026-09-23
Real-time status: status.raxar.es
Row-Level Security in PostgreSQL on every table with client data. Isolation is mathematical at the database level, not at the application layer.
TLS 1.3 on every HTTPS endpoint. HSTS with max-age 1 year + preload. External backups travel and are stored encrypted at source —contents and file names— with a key the storage provider does not hold.
2FA mandatory for administrative roles. Account lockout after 5 failed attempts. Shannon-entropy password policy. Bcrypt 12 rounds.
Strict CSP · X-Frame-Options DENY · X-Content-Type-Options nosniff · Referrer-Policy strict-origin-when-cross-origin · Restrictive Permissions-Policy.
Self-hosted error tracking (Glitchtip), with error reports filtered before they are sent: email, phone, national ID, IBAN, card and credentials are stripped at source. Public monitoring at status.raxar.es (Uptime Kuma). Tested DR runbook · daily offsite backups with tested restore.
Signable DPA available on request. Right-to-erasure endpoint. In the systems we run, personal data is redacted before being sent to third-party LLMs; the public chat on this website does not carry that filter yet, and we say so right there. Product analytics (PostHog · EU servers) is not active on this website today. Audience measurement (Google Analytics) is opt-in and detailed in the cookie policy.
We are transparent: we don't yet hold formal external certifications. We planned them based on real commercial traction, not as empty marketing.
GDPR ready
DPA template + export + erasure endpoints
SOC 2 Type I
It is one of our objectives; no audit has been engaged yet
External pen-test
Annual audit with specialized firm
If you've detected a vulnerability, unusual behavior, or any security issue in our systems, we want to hear from you. We acknowledge receipt within 3 business days.
Contact: security@raxar.es
Acknowledgments: /en/seguridad#hall-of-fame
Preferred-Languages: es, en, pt
Policy: /.well-known/security.txt
We will not legally pursue security researchers acting in good faith within a reasonable scope (no data exfiltration · no service disruption · private notification before public disclosure).
Public acknowledgment to researchers who have reported responsible vulnerabilities. Currently blank · we are in internal dogfooding phase and we're proud of that empty space because it means we haven't needed to fill it yet.
If you need a custom DPA, deployment in your cloud environment, isolated infrastructure audit, SSO integration with your corporate IdP, or specific SLA, we can design a tailored enterprise setup.
Talk to our security team →