Security & trust
Built to pass your review.
This page collects what a security, legal, or procurement review typically asks for. Every section is linkable. If something you need is missing, ask us and we will add it.
The short version
- Hosted in the EU (Hetzner, Germany/Finland), with no US-hosted database.
- Feedback is stored without any link to its author, by design. The published anonymity design shows how.
- Messages are deleted after 12 months; uninstalling deletes your workspace's data immediately.
- DPA available on request, signable same-day.
- Flat per-workspace pricing. We never track individual usage, so there is nothing per-seat to audit.
Sub-processors
The complete list of third parties that process customer data, and exactly what each one sees:
| Provider | Purpose | What it processes | Location |
|---|---|---|---|
| Hetzner | Hosting (servers & database) | All stored data, as described in the anonymity design | Germany / Finland (EU) |
| Cloudflare | DNS, TLS, CDN for this website | Network traffic in transit; no stored application data | Global edge |
| Slack | The platform Sincere runs on | Everything you do in Slack, under Slack's own policies | Per your Slack plan |
| Anthropic | AI content moderation | Message text only, at submission. Never user IDs, workspace IDs, or timestamps. Nothing from the exchange is stored. Not used for model training per Anthropic's commercial terms | United States |
| Paddle | Payments (merchant of record), once paid plans launch | Billing contact and payment details of the person who subscribes. Never feedback content, never member lists | UK / EU |
| Bubblegram | Support chat on this website | Visitors' IP address and a session token on each page load; messages, the email given and browser type only from people who write in the chat. Not part of the product: it never sees feedback content, votes, or anything from Slack | EU |
We will update this list before adding any new sub-processor. There is no analytics or tracking script on this website or in the product. The website's only third-party script is the support chat bubble.
Data retention
- Posted messages and vote records: deleted 12 months after posting. An automated sweep runs every minute.
- Rate-limit and moderation tokens: expire within 24 hours, deleted every minute. These are keyed hashes, never user IDs.
- On uninstall: all workspace data is deleted: messages, votes, queued submissions, reporting settings, and the installation itself. Slack's uninstall event triggers it automatically. Two workspace-level records are kept: the billing record of a paid subscription, which runs independently of the Slack install until it is cancelled, and the date your workspace first installed Sincere, so that installing again does not start a second free trial.
- Reports store nothing new. The weekly digest, the Home tab and the CSV export are generated on demand from the messages and vote totals above. We keep one setting per workspace, the channel reports go to, and no list of who may view them. Access is membership of that channel, checked with Slack each time.
- Rejected messages are never stored at all, and neither are moderation verdicts.
- Messages posted into your Slack channel remain in Slack under your workspace's own retention settings. Deleting our copy can't recall what was already posted to your team.
The retention rules are enforced in code and described in the same published design as the anonymity scheme.
GDPR & data residency
- Application and database run on Hetzner in Germany/Finland (EU). No US-hosted database or backups.
- For workspace data, your company is the controller and Sincere is the processor, governed by a DPA.
- Data minimization is built into the schema: feedback and votes are stored with no link to the person behind them, so the most sensitive data, who said what, never exists on our side.
- One consequence: because posts cannot be tied to individuals, subject-access and selective-deletion requests cannot cover message content. There is no way to find "your" messages. A workspace admin can request (or trigger, by uninstalling) deletion of all workspace data.
- The single cross-border flow is moderation: message text (and nothing else) is processed by Anthropic in the US at submission time. It carries no identifiers.
Data Processing Agreement
A standard DPA (GDPR Art. 28) is available on request and can be signed the same day. Request it by email. It covers the processing described on this page: scope, sub-processors, retention, breach notification, and deletion on termination.
Uptime
We target 99.5% monthly uptime. This is an operational target, not a contractual SLA on self-serve plans; a contractual SLA is available on Enterprise agreements.
If the service is briefly down, a submission fails with a visible error and can be retried. Nothing is silently lost, and already-scheduled messages post once service resumes.
Support
| Severity | Examples | First response |
|---|---|---|
| Urgent | Service down, suspected security or anonymity issue | 1 business day |
| Standard | Questions, configuration, billing | 3 business days |
Contact: hello@orangevector.io. Reports of suspected security issues are welcome. The anonymity design is published so people can test it.
Security practices
- TLS on all connections; the database is never exposed to the internet.
- The anonymization secret lives only in the server environment, never in the database or in backups, so a leaked database or backup alone cannot deanonymize anyone.
- Minimal Slack permissions: slash commands, posting messages, reading channel names, counting workspace members (for the pricing tier) and checking admin status, seeing who is in the private channel you choose for reports, and uploading the CSV export there. At install, the admin's own permission is used once to add the bot to the feedback channel. No message-reading permission of any kind: Sincere cannot read your channels or DMs.
- Application logs never contain user IDs together with message text; request payloads are never logged.
- The anonymity-critical code paths are covered by tests asserting that raw user IDs never reach the database layer.