Least access. Named parties. No surprises.

The plain version of how we keep data safe: least access, EU-first processing, encryption in transit, and a short, named list of the services we rely on. Nothing hidden.

How we handle data

We work on a least-privilege basis: each person and each service gets the narrowest access that does the job, and nothing more. Traffic to the site and to the tools we run is encrypted in transit with HTTPS. Secrets and API keys live in managed secret stores, never in source code. In the databases we build, access is enforced at row level, so one account cannot read another's data.

Who processes data for this site

Three named providers, each only to the extent the service requires:

• Vercel Inc. Hosting and technical logs. EU and United States, under EU-approved transfer mechanisms.
• Cal.com Inc. Call booking (your name, email and message) and the confirmation emails. EU and United States, under EU-approved transfer mechanisms.
• Google Bookings sync to our Google Calendar.

The site sets no cookies and runs no analytics. The Privacy notice has the full detail.

In the software we build for you

Projects typically run on a Postgres database with row-level access control and managed authentication, hosted in an EU region, with GDPR-first design from the first sprint. The exact stack and the subprocessors are agreed with you, written into the project, and you get the accounts.

Your data in AI features

When a feature uses a third-party model, your data is sent to that provider only to produce your result, under the provider's data terms, and is not used to train their models. You choose the provider, and we name it before the feature goes live.

Reporting a vulnerability or incident

Found a weakness in something we built or run? Write to puddles@puddles.fi. We respond without undue delay, and if a security incident affects your data, we tell you and work through it with you.

See also · Privacy · Responsible AI