Privacy & Security
EU data sovereignty, tenant isolation, and how we think about trust
Privacy is Stacular’s founding constraint, not a feature we added later. This page describes how that plays out in the architecture and in how we operate.
EU data sovereignty
Stacular is built, operated, and hosted in Europe on infrastructure we control — no hyperscaler dependency, no data leaving the EU as a side effect of some upstream service. For organizations subject to GDPR and European data-protection expectations, this removes the hardest questions before they come up.
Tenant isolation
Every organization is a tenant with its data isolated at the database level through row-level security. Isolation is enforced by the database itself on every query, not by application code remembering to filter. Your organization cannot see another organization’s data, and neither can a bug in a feature.
Per-tenant encryption
Sensitive credentials, such as the mail account passwords that connect your organization to its mail backbone, are encrypted per organization with keys managed in a dedicated secrets infrastructure. Decryption happens only in the backend at the moment of use. The frontend never handles raw credentials.
No ads, no tracking, no resale
Stacular’s business model is subscriptions. We don’t run ads, we don’t build advertising profiles, we don’t sell or share your data, and we have no incentive to look at it. Analytics on the product are minimal and functional.
Auditability
Organization-level audit logging records administrative and security-relevant actions, designed so that entries cannot be silently altered. Audit tooling is expanding through the pilot program toward the compliance needs of larger organizations.
Self-hosting
The platform is designed to be self-hostable, and a self-hosted option for enterprises is on the roadmap. The same property keeps us honest: software you could run yourself can’t hide surprises.
Responsible disclosure
If you believe you’ve found a security issue, please email hello@stacular.com and we’ll respond quickly. We appreciate coordinated disclosure and will credit researchers who report in good faith.