# ErmisAI security and data handling

> Last updated: 2026-09-03. Generated from the same content that renders https://ermisai.com/security. It states what is implemented, not what is planned.

> What ErmisAI has. Not what we hope to have. Role-scoped access, sensitive-topic review, source-grounded workflow signals, usage metering, and subprocessors listed by category.

## Data residency

| Layer | Location |
| --- | --- |
| Primary database (tenant data, editorial records) | EU - Helsinki, Finland |
| Application compute | EU - Stockholm, Sweden, plus a global edge CDN |
| Object storage (uploads, payload archives) | Hosting platform object store; archives under a private ACL |

Company location: Greece.

## Managed infrastructure

Security-critical layers run on managed services rather than custom infrastructure. Each provider is responsible for their own layer. Specific provider names and DPA terms are available before contract.

| Layer | Responsibility | Detail |
| --- | --- | --- |
| Authentication | Authentication and session management | Authentication, sessions, and organisation membership are delegated to a managed identity provider. ErmisAI does not store or manage raw session credentials. |
| Billing | Billing and subscription lifecycle | Payment processing, subscription state, and checkout flows run through a managed billing provider. Card data never touches ErmisAI servers. |
| Database & storage | Primary database & object storage | Application state, tenant data, and editorial records live in a managed Postgres cluster in the EU (Helsinki, Finland); uploaded media and payload archives live in the hosting platform's object store, with archives held under a private ACL. Backups, failover, and encryption at rest are handled by the providers. |
| Cache and rate limiting | Rate limiting and transient state | In-memory state for rate limiting, feed processing locks, and short-lived workflow flags. No persistent sensitive data stored here. |
| Compute, hosting & edge | Compute, hosting, edge delivery & object storage | Application compute, routing, edge CDN, and object storage run on a managed hosting platform (compute in the EU, Stockholm, plus global edge). Network isolation, DDoS mitigation, and TLS termination are platform defaults. |

## Product controls

Controls implemented at the application layer, visible in the current codebase.

- **Role-gated product areas** Admin routes and tenant newsroom routes are separated at the middleware level. Platform-side roles for operations are distinct from tenant-side editorial roles. Access is enforced server-side on each request.
- **Webhook signature verification** Billing and identity webhook events are verified against HMAC signatures from their respective providers before processing. Replayed or tampered payloads are rejected. Idempotency keys prevent duplicate processing of the same event.
- **API key hashing** Tenant integration keys are stored as hashed values with truncated masked prefixes for display. The full key is shown only once at creation time and cannot be retrieved from the platform after that.
- **Network checks for webhook targets** Outbound webhook endpoints submitted by tenants are validated against reserved and non-public address ranges before use. This blocks SSRF attacks targeting internal network addresses via the webhook delivery system.
- **Operational records** Billing and identity webhook payloads are archived for audit and incident investigation. These records support troubleshooting without relying solely on external provider logs.

## GDPR and compliance posture

- GDPR: data-subject access and erasure are implemented as a product subsystem, not a manual process. Erasure requests run on a grace period and then purge.
- A Data Processing Agreement is available; subprocessors are published by category.
- AI processing and retention are disclosed in the AI policy.
- ErmisAI does not claim SOC 2 or ISO 27001 certification. If a certification is a procurement requirement, raise it before contract rather than assuming it.

Policy documents:

- Terms of service: https://ermisai.com/legal/terms
- Privacy notice: https://ermisai.com/legal/privacy
- Cookie notice: https://ermisai.com/legal/cookies
- GDPR and data rights: https://ermisai.com/legal/gdpr
- Data processing agreement: https://ermisai.com/legal/dpa
- Subprocessors: https://ermisai.com/legal/subprocessors
- AI policy: https://ermisai.com/legal/ai-policy
- Data portability and exit: https://ermisai.com/legal/data-portability
- Accessibility statement: https://ermisai.com/legal/accessibility
- Legal notice: https://ermisai.com/legal/imprint

## Reporting a vulnerability

Report security issues to security@ermisai.com, or through https://ermisai.com/contact.