Security & data
Control the boundary.Understand the trade-off.
Scoped access, explicit data collection and reviewable production changes. This page lists what NanoFlags receives, where it is kept and for how long.
Scoped access
Separate browser, server, CI and administration keys.
Reviewable changes
Independent approvals and versioned audit events.
Selective diagnostics
Collect a bounded, redacted sample with defined retention.
The data boundary
Your application data stays intentional.
Configuration travels down to your app as a signed bundle. Decisions are made inside your app. What comes back up is a bounded sample you control.
NanoFlags edge
Cloudflare network
Signed configuration bundle
Ed25519 · browser keys: client-exposed flags only
Diagnostics sample
10% by default · attribute names and types, not values
Your application
SDK · local evaluation
Evaluation context stays here
What to expect, area by area
- Configuration
- Browser keys receive only client-exposed flags and the segments those flags reference. Server keys receive the whole environment. Every published bundle is signed with Ed25519.
- Context attributes
- SDKs evaluate flags inside your application; the evaluation context is not sent to NanoFlags to make a decision. Diagnostics send attribute names and types by default, not values.
- Diagnostics
- A bounded sample of evaluations (10% by default), capped per environment per day and deleted after your plan's retention: 3, 14 or 30 days.
- Key revocation
- A revoked key is normally refused at the edge within about a minute. An SDK that already holds a configuration keeps evaluating it until it restarts.
Accounts and operations
Safeguards around the workspace.
How accounts are protected, how organizations are kept apart, and what happens if data has to be restored.
Open the status pageTwo-step verification
TOTP · recovery codes
Sign-in can require an authenticator app (TOTP), with one-time recovery codes. An organization can require it for owners and admins; the database refuses their changes from a session that hasn't completed it.
Tenant isolation
row-level security
Every table is protected by row-level security in the database. An automated isolation suite signs in as a member of one organization and tries to read and change another organization's data through every table and function; each attempt must return nothing or fail.
Backups
hourly · 30 days
Customer configuration is exported every hour and stored outside the main database, where each export is kept for 30 days. The database provider's daily backups come on top of that.
Public status page
/status
Live checks of each component, measured propagation, and incidents with updates until they are resolved.
Data location
Where data is stored and processed.
These are the service providers that run NanoFlags, what each one handles and where. The privacy notice has the full detail.
| Provider | What it handles | Where |
|---|---|---|
| Supabase | Database and authentication: account data, workspace content, audit log and diagnostics. | Where: Mumbai, India (AWS ap-south-1) |
| Cloudflare | Hosting of the website and dashboard, and the edge network that serves configuration to SDKs. | Where: Cloudflare's global network |
| Resend | E-mail delivery: sign-in links, invitations, approval requests and publication notices. | Where: Tokyo, Japan |
| Sentry | Error monitoring for the website, dashboard and edge services. Configured not to collect cookies, request bodies, query strings, IP addresses, names or e-mail addresses. | Where: European Union (Germany) |
| Paddle | Merchant of Record for all orders: payment, tax and invoicing. | Where: Under the Paddle privacy notice |
| GitHub | Only when your organization installs the NanoFlags GitHub App: repository events, pull request comments and check runs. | Where: Under GitHub's privacy statement |
Providers may process data outside the country where you live; where the law requires it, transfers rely on the providers' standard contractual clauses or an equivalent safeguard.
Security & data
Need security details?
Ask about the data boundary, key policies and operational practices.
Contact the team