Security

How we protect data

Martello Systems is a small company: one founder, supported by AI agents. We keep the security basics tight and tell you plainly where we are still working.

• Keys live in a gateway, not in each app. Third-party provider keys are held in a credential gateway on Cloudflare, and our apps call providers through it. We are finishing the move of the last remaining keys off app servers.
• Least privilege. Each app has its own identity on the gateway and is scoped to the providers it needs. Every app must present its own credential, and the gateway refuses calls that do not.
• Encryption in transit. Our sites, apps, and calls to providers use TLS.
• Encryption at rest. Our databases run on Neon PostgreSQL and Supabase (for Mycel), which encrypt stored data at rest.
• Code and changes. Source code is kept in our self-hosted Forgejo with a backup mirror, and changes are reviewed before they ship.
• No selling of data. We do not sell personal information.

Sub-processors

Providers that may handle customer data on our behalf include Anthropic, OpenAI (backup AI only), Twilio, Vapi, Deepgram, Brevo, Stripe, Google, Apple, Cloudflare, Neon, Supabase, and Hostinger. Meta and Square receive data only when a customer connects them. How each is used is described in our Privacy Policy, and Relay lists its own sub-processors in its privacy policy at gorelaycrm.com.

Reporting a vulnerability

If you think you have found a security problem, email [email protected]. Please include what you found and how to reproduce it, and avoid accessing other people's data. We will acknowledge your report and keep you updated on the fix.

Security questionnaires

We keep a completed standard security questionnaire. Ask us at [email protected] and we will send it.

Compliance

We do not have a SOC 2 report today. We maintain written security policies and a readiness pack, and we will commission an audit when a customer contract requires it.