Legal

Security and Vulnerability Disclosure

What protects your data, what we deliberately do not claim, and the terms under which you can go looking for holes in it.

Last updated 17 September 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the operator’s address, several retention periods, confirmation of which provider agreements are actually signed, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

35 outstanding items— show

serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at
commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does
VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is
second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly
how the current-month refund promise applies to an annual plan — a twelfth, the unused remainder, or not at all. Decide before an annual plan is sold
the refund window on a founding lifetime purchase — 30 days from payment is the reading this draft assumes, and it needs confirming rather than inheriting subscription wording
languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into
the seller for a paid contract — for a Paddle purchase, the Paddle entity named at checkout and on the invoice, with its postal address and email
Review of all ten documents, the Impressum and the implementation-fund rules by a lawyer in Germany — after the operator's address and registration position are settled, because that is half of what counsel checks.
Whether a data protection officer has to be appointed despite the headcount, which turns on whether location-linked consultation and survey responses amount to processing that requires a data protection impact assessment.
The roles in each institutional feature — whether a municipality is a controller, our controller, or a joint controller for consultations, residency registers and street reports — and the agreement that follows from each answer.
Which provider arrangements are actually signed, in which regions, and under which transfer mechanism. The provider table states what the code configures, which is not the same as a countersigned contract.
Whether the service is an online platform under the Digital Services Act rather than only a hosting service, and which of the platform duties the micro and small enterprise exemption removes.
Whether direct access to the production database is logged, and whether a backup restore has ever actually been run.
which accounting records fall in the 10, 8 and 6-year tiers of §147 AO — the periods differ by document class and run from the end of the calendar year, and the old ten-years-for-everything line was over-retention
when an invitation that is never accepted expires — it is an access grant sitting open, and "until somebody revokes it" is not a period
a period per category for correspondence — handling, then a justified follow-up or claims window. "Until somebody asks us to remove it" is not a retention period, it is the absence of one
how long verification evidence is kept after the thing it verified is decided — the decision has to outlast it, the document usually does not
when a waiting-list subscription expires if the list is never used — it survives account deletion, because it was left without needing an account
how long the identifiers that survive a webhook payload are kept — they are what stops a duplicate, and they are still linkable to a transaction
whether attribution should expire before the account does — it answers a question about a signup that stops being asked long before the account closes
the purpose and lawful ground for keeping a country code on the signup record. It is written whether or not attribution was accepted, which the privacy policy used to deny, and currency presentation does not need it stored
the retention configured on the analytics project, and whether an erasure here propagates to it
how long the evidence of a rights request is kept after it is met — a justified period, rather than "kept"
a schedule per civic feature, and the controller each one belongs to. A municipality running a consultation sets its own period; where we set it, it has to be written down
each provider's own log retention, and the maximum age of a backup before it expires
a justified maximum for the staff audit log, and the rule that reviews it. The 180-day expiry of the identifying half is enforced; the row itself has no end
a justified maximum for the record of a support session — somebody here opening your account to help — on the same footing as the staff audit log above
where the Photon instance we call actually runs, and who operates it
where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions
the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory
the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume
a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets
whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent
a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing

1. Reporting a vulnerability

Write to hello@streetshape.org with “Security report” in the subject.

Tell us the affected URL or component, the steps to reproduce it, what you think the impact is, and the minimum evidence that shows it. Do not send somebody else’s personal data and do not post a working exploit publicly. If you need to send sensitive evidence, ask us for a secure way first.

We acknowledge a report within 2 working days and keep you reasonably updated. That is a promise about answering, not a promise to fix everything within a fixed time.

There is no standing paid bug bounty, and no reward is promised unless we agree one separately. The same address is published at /.well-known/security.txt.

2. What you may test

This policy authorizes limited, good-faith testing of StreetShape’s own application functions, using your own accounts and your own data, within these boundaries:

Use the least testing needed to demonstrate the issue.
Do not deliberately access, copy, alter or delete anybody else’s information. If you reach something unexpectedly, stop and tell us.
No denial-of-service, no load testing, no intrusive automated scanning.
No phishing, social engineering, physical attacks, credential stuffing, extortion, or leaving anything behind after testing.
Do not test third-party infrastructure under this policy — the providers on the subprocessor page have their own programmes and their own permission to give.
Ask us before doing anything outside these boundaries, or where the scope is unclear.

3. Safe harbour and coordinated disclosure

Our commitment

For research that follows this policy, we will not start legal action against you, and we will not report it as unauthorized activity to your employer or your internet provider, solely because you did that research.

This binds us and only us. It cannot authorize access to somebody else’s systems, and it cannot bind an authority or another rights holder. That is a limit of what any company can promise, and pretending otherwise would be the one dishonest sentence on a page about honesty.

We ask you to coordinate disclosure and normally allow 90 days from a sufficiently detailed report for us to investigate and fix. A different period can be agreed, taking account of active exploitation and of protecting users. We will discuss disclosing sooner where that is right, and we will not ask you to keep something secret indefinitely.

We will credit you publicly if you want that. A report is welcome even when we disagree about severity or cannot reproduce it — that may affect how we prioritize it, and it does not turn a report into misconduct.

4. What is in place

Safeguards proportionate to the service and its risks, meant to protect confidentiality, integrity and availability:

A specialist authentication provider, with two-factor options. Passwords and authentication secrets never reach our own systems.
Access control in the database itself, through row-level security policies, rather than only in application code.
Role separation for staff, with administrative actions restricted by role and logged — including the ones that were refused.
Support sessions that are read-only, expire after no more than thirty minutes, record who opened one and why, and email the account holder that it happened.
Input and upload validation, with image metadata — including GPS tags — stripped on upload.
Encryption in transit, and provider-managed encryption at rest.
Security headers, same-origin protections, dependency auditing and rate limiting.

None of this guarantees that a vulnerability, a misconfiguration, a misuse of privileged access or a loss of data cannot happen. The controls reduce the chance and the blast radius. That is what controls do.

5. What we do not have

The honest list

No ISO 27001 certification.
No SOC 2 report.
No completed independent penetration test.
No tested and guaranteed recovery time, and no published uptime commitment unless one is expressly agreed with you.

Two more, which are open questions rather than settled positions and appear in the list at the top of this page: whether direct access to the production database is logged, and whether a backup restore has ever actually been run. An untested backup is a hypothesis.

Payment security

Full card credentials never reach our systems — Paddle handles them as merchant of record. Using a merchant of record is not a certification, and it does not by itself discharge every payment-security responsibility we might have. It removes the largest one.

6. If there is a breach

We assess a suspected personal-data breach promptly. Where the law requires it we notify the competent authority without undue delay and, where feasible, within 72 hours of becoming aware — explaining any delay. We notify the people affected without undue delay where the high-risk threshold and the other statutory conditions are met.

Where we are acting as somebody else’s processor, we notify that controller without undue delay and follow the incident procedure we agreed with them.

A notification says what happened, what the likely consequences are, what we are doing about it and who to contact, so far as we know at the time. We would rather send a second message with more detail than delay the first one until everything is certain.

7. Getting in touch

Security reports to hello@streetshape.org. Anything about personal data, including a breach affecting you, is covered by the privacy policy and the data protection and your rights page.