Security at Reditus

Last updated: 4 August 2026.

This page summarises how Reditus B.V. protects the data on its platform. The binding version of these commitments is Annex B of our Data Processing Agreement; this page is the plain-language summary. If you are running a vendor security review and need more than what is here, email privacy@getreditus.com and we will answer your questionnaire.

Where your data lives

All production customer data is stored at rest in the European Union: application servers with Hetzner Online GmbH in Nuremberg, Germany, and the database, authentication and file storage on Supabase in Frankfurt, Germany. Hetzner holds ISO/IEC 27001:2022 for its hosting services and data centres; Supabase states that it holds SOC 2 Type 2 and ISO/IEC 27001. Those certifications belong to those providers. Reditus holds no security certification of its own today, and we would rather say that plainly than imply otherwise. Cloudflare provides DNS, edge protection and delivery in front of the platform.

Encryption and access

All traffic to and from Reditus is encrypted in transit with TLS, and data is encrypted at rest. Encryption alone never makes data inaccessible to everyone, so we pair it with access controls: access to production systems is limited to the people who need it for their role, everyone with access signs a non-disclosure agreement before access is granted, and authentication tokens are stored hashed (BCrypt) and expire after two weeks. Affiliates never see the full email addresses of referred customers; addresses are partially masked (j****@example.com).

Data minimisation by design

You decide how much personal data reaches us. With UID tracking, you send opaque account identifiers instead of email addresses. Taken to its full extent, you can integrate entirely server side through our API, reporting referrals and payments with unique identifiers only and no tracking script on your site at all, in which case Reditus receives no personal data about your clients. Our tracking script does not fingerprint devices: it reads no screen, canvas, audio, hardware or storage signals.

Secure development

Every build runs static security analysis (Brakeman) and dependency vulnerability scanning (Bundler Audit) before it can deploy. Staging deploys automatically; production deploys are a manual, deliberate step. The API is rate limited. The backend test suite covers more than 95 percent of lines.

Monitoring, backups and continuity

Errors and performance are monitored continuously, with uptime monitoring and alerting on top. The production database is snapshotted daily with rollback available for the preceding 7 days; no longer-term or off-platform archive exists, so deleted data ages out of backups within that window.

If something goes wrong

We notify affected customers of a personal data breach without undue delay and in any event within 48 hours of becoming aware, so you can meet your own 72 hour deadline, followed by a written root cause analysis within 30 days of containment. Details are in clause 6 of the DPA.

Sub-processors

Every vendor that processes customer personal data is listed at /sub-processors with its legal entity, purpose, location and transfer safeguard. We give at least 30 days' notice before a new sub-processor starts processing customer personal data, and you can object as described in the DPA.

Supply chain requirements (NIS2)

If your organisation is regulated under NIS2 or the Dutch Cyberbeveiligingswet and needs supplier security commitments, the DPA plus this page cover the substance; where your compliance team needs a specific rider, contact us at privacy@getreditus.com.

Reporting a vulnerability

Found a security issue? Email privacy@getreditus.com. We take reports seriously, will acknowledge within 5 working days, and will not take legal action against good-faith research.