Security

Where to send a vulnerability report, what we promise you for sending it, and an honest account of how StreetShape is built.

Last updated 30 August 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the company details, the governing law and the retention periods a human has to decide, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

31 outstanding items— show

legal entity name
country of incorporation
company registration number
VAT number
registered office address
EU representative, if the entity sits outside the EU
data protection officer, if one is required
supervisory authority
supervisory authority website
governing law and jurisdiction
ADR body to signpost, if the jurisdiction requires one
minimum age — GDPR Art. 8 allows 13 to 16 by member state
refund position, beyond the statutory withdrawal right
liability cap
voluntary refund window — the draft recommends 30 days
window for refunding a renewal somebody meant to cancel — the draft recommends 14 days
acknowledgement time for a vulnerability report — the draft recommends 2 working days
coordinated disclosure window — the draft recommends 90 days
notice period before a new sub-processor starts, for accounts with a DPA — the draft recommends 30 days
canonical domain — the code uses streetshape.app, the site publishes streetshape.io
Whether classroom use is supported — the education material invites it, which makes under-16 users foreseeable and decides the minimum age above.
The statutory retention period for accounting records in the country of incorporation.
Retention windows for municipality demo requests, the email log, and stored Paddle webhook payloads.
Whether Paddle's checkout captures the Art. 16(m) consent and acknowledgement the Terms rely on for digital content supplied immediately.
The region each processor runs in, and the transfer mechanism relied on for each.
Review of all nine documents by a lawyer in the jurisdiction of incorporation.
Whether a data processing agreement is actually executed with each provider on the sub-processor list, and whether a StreetShape DPA template exists for a municipality or university to sign.
Which imagery and elevation providers sit behind MapTiler's satellite and terrain styles, read from the styles themselves rather than written from memory.
Whether MapTiler's agreement permits printing and republishing satellite imagery, which is a different grant from viewing it on screen.
Whether the Digital Services Act treats StreetShape as a hosting service or an online platform — public proposal boards and consultations point at the second, which carries notice-and-action, statement-of-reasons and appeal duties.
Whether access to production data is logged, and whether a backup restore has ever actually been run.

1. Reporting a vulnerability

Email hello@streetshape.io.

Tell us what you found, how to reproduce it and what you think the impact is. We will acknowledge within [acknowledgement time for a vulnerability report — the draft recommends 2 working days] and keep you updated until it is closed.

What we promise you

We will not take legal action against good-faith research that follows the rules below, and we will not complain to your internet provider or your employer about it.
We will work with you on the fix and on the timing of any disclosure.
We will credit you publicly if you want that, and not if you do not.
We will tell you when it is fixed.

2. The rules

Do not access, change or delete anybody else’s data. If you come across somebody’s plans, stop and tell us.
Test against your own account.
Do not degrade the service: no denial of service, no load testing, no automated scanning heavy enough to be felt.
No social engineering, phishing or physical attacks against us, anyone who works with us, or our providers.
Give us reasonable time to fix it before publishing. [coordinated disclosure window — the draft recommends 90 days] is our default, and we will usually be much faster.

Out of scope

Anything inside a third-party service — Clerk, Supabase, Paddle, MapTiler. Report those to the provider, and tell us too if it affects StreetShape.
Missing security headers with no demonstrated impact.
Rate limiting on unauthenticated endpoints, unless you can show real harm.
Scanner output with no manual verification.
Social engineering of our users.

We do not run a paid bug bounty. If you find something serious we will find a way to say thank you properly.

3. How StreetShape is built

For anyone assessing whether to use or recommend it.

Authentication

Handled by Clerk. We never see or store a password. Two-factor authentication is available on every account, with recovery codes, from your account settings.

Access to your data

Your plans are protected by row-level security policies in Postgres, not only by application code. That distinction is the whole point: a bug in our front end cannot expose somebody else’s plan, because the database refuses the query rather than trusting the caller.

Plan limits work the same way — enforced by database triggers underneath every path a client can reach, rather than by browser code that could be worked around.

Both are checkable rather than aspirational: row-level security is enabled on every table holding user data, and the plan-limit trigger fires on insert regardless of which API route, RPC or client made the call.

Payments

Paddle is our merchant of record. Card details never reach our systems, which puts us out of scope for PCI DSS rather than merely compliant with it.

In transit and at rest

Everything is served over TLS, and the database and file storage are encrypted at rest by Supabase.

Dependencies

The dependency set is deliberately small and every version is pinned in a committed lockfile, so what runs in production is what was reviewed. Automated alerting on known vulnerabilities in those dependencies is not configured yet — see below.

4. What we do not have yet

We are a small team, and we would rather tell you what is missing than let you assume it is there.

No independent penetration test has been carried out.
No SOC 2 or ISO 27001 certification. If your procurement process needs one, tell us and we will talk about what is possible.
No formal bug bounty programme.
No automated dependency vulnerability alerting. Versions are pinned and reviewed, but nothing watches them for a published advisory yet.
No published uptime commitment outside a municipal agreement.
Nothing published yet about staff access to production data or about backup restores. Both are marked as open above rather than described optimistically — a security page is exactly the wrong document to be aspirational in, because it is read by people whose job is to check.

This section stays on the page as things improve rather than disappearing. A security page with no gaps listed is a security page nobody has looked at.

5. If something goes wrong

If personal data is breached, we will notify the relevant supervisory authority within 72 hours where the GDPR requires it, and tell affected users without undue delay where the risk to them is high. Where a municipality or institution is involved as a controller, we will tell them immediately.

What we would tell you: what happened, what data was involved, what we have done about it and what you should do.

6. Getting in touch

Security reports: hello@streetshape.io, which is also what /.well-known/security.txt publishes. Anything else: the contact page.

Who processes data for us is on the sub-processors page. What we hold and for how long is in the privacy policy. Probing the service without permission is covered by the acceptable use policy — reporting something you found under the rules above is not.