Where your data lives, who touches it, how it's protected
MOJAQ is built EU-first. Here is the honest, specific version: our infrastructure, subprocessors, retention, security measures and how to reach us. No hand-waving.
Where your data is stored
MOJAQ's core application databases and service storage run on infrastructure in Helsinki, Finland (Hetzner). Encrypted backup copies are configured to remain in the EU.
Subprocessors
| Provider | Purpose | Location | Customer data at rest? |
|---|---|---|---|
| Hetzner Online GmbH | Dedicated server hosting (all products + storage) | Germany / Finland (EU) | Yes — core storage is EU-hosted; off-site backup copies are encrypted |
| Cloudflare, Inc. | TLS termination, CDN, DDoS protection, bot challenge | Global edge (US entity) | Processes request and connection data; retention depends on contracted configuration |
| Resend | Transactional / account email delivery | US entity | Recipient address and message content |
| Customer-selected AI provider | Optional AI inference through the gateway | Customer/provider dependent | Customer payloads according to provider terms |
We do not sell data or use advertising trackers. The published Data Processing Agreement is currently a working template with fields that must be completed and reviewed before execution. Dashboard residency reports are informational working summaries, not signed attestations or independent audits.
Data retention
- Analytics: cookieless event and session records used to produce aggregate reports; no cross-site advertising profiles; retained per plan.
- Logs: 7-day retention during the beta.
- Errors, uptime, deploys: retained per plan; incident history kept for context.
- Render: documents processed transiently; temporary files removed after conversion.
- Realtime: messages are delivered, not persisted after delivery.
- On account deletion: deletion is coordinated across multiple backing services and databases. Encrypted off-site copies older than 30 days are scheduled for pruning after a successful backup upload; failed or missed maintenance can delay pruning, so 30 days is not a guaranteed hard-expiry deadline.
Security measures
- TLS is used on public endpoints; origin-firewall state is monitored because it depends on active host controls.
- Per-tenant data isolation enforced at the database layer.
- API keys are stored hashed and passwords use a modern KDF. Selected application fields use envelope encryption. Deployment credentials are restricted owner-only files or mounted secrets, excluded from service-data backups, and require a separately controlled recovery source.
- Email verification, IP-velocity and disposable-email abuse prevention, and a bot challenge on signup.
- Role-based team access.
- Encrypted off-site backups. The candidate release design requires an exact off-host restore verification and signed receipt before release; rely on that control only when current operational evidence shows the verifier and receipt flow are enabled.
- Independent external monitoring is intended to detect a total hosting outage; rely on it only when current operational evidence shows the external monitor and alert path are enabled and healthy.
Reliability, honestly
During the private beta MOJAQ runs in a single EU region (Helsinki). Encrypted off-site backups are configured, while independent external monitoring and automated off-host restore checks are intended operational controls and must not be treated as active without current evidence that their timers, verifier and alert paths are enabled and healthy. We do not offer a formal uptime SLA or independent security certification.
Reporting a vulnerability
Found a security issue? We want to hear about it. Email [email protected] (see /.well-known/security.txt). Please give us reasonable time to fix before disclosure, and we will keep you updated.