Security

• Service data is stored with Amazon Web Services in Stockholm, Sweden (eu-north-1).
• Data is encrypted at rest (database and file storage) and in transit — Propiler is only served over TLS.
• The database has point-in-time recovery for 35 days, and deletion protection on the database and the user directory.

• Passwords must be at least 12 characters. There are no rules about character types, and long passphrases are encouraged.
• Two-step sign-in (a one-time code by email) is available to every account.
• Every request is authorized on the server, and each workspace and organization is kept separate from the others.
• Changes to who has access are recorded in an append-only audit log.
• Our own cloud access follows least privilege.

• Infrastructure is defined as code and every change passes automated checks before it ships.
• Logs are kept for 90 days; alarms tell us about errors and unusual traffic; cloud management actions are recorded.
• The API has rate limits.
• Dependencies are monitored, and we patch on a monthly patch day — urgent fixes sooner.
• The web app sends strict security headers (content security policy, HSTS, no framing) and contains no analytics or tracking.

We tell affected customers without undue delay — we aim for 24–48 hours — and, where we are the controller, the Swedish data protection authority (IMY) within 72 hours of becoming aware of a personal data breach.

Propiler is not certified to ISO/IEC 27001. Our security work follows its structure, and organizations can ask us for details at support@crdbag.com.

Email support@crdbag.com with what you found, how to reproduce it and the impact you see. We confirm that we got your report and keep you informed while we fix it.

• Only test against your own account and data. Do not access, change or delete other people’s data.
• Do not disrupt the service — no denial-of-service tests, spam or social engineering.
• Give us reasonable time to fix the problem before you tell anyone else.

If you follow these rules in good faith, we will not take legal action against you for your research. Our contact details are also in /.well-known/security.txt.