This page describes the real Splnit.eu security posture. Work in progress is labeled as work in progress.
The application runs on Vercel, application data is stored in Neon Postgres, and production sub-processors are listed in the DPA overview.
Transport is encrypted over HTTPS. Integration tokens are encrypted and production access is restricted by role.
Splnit.eu publishes its own Trust Center with framework status, contacts, DPA, privacy policy, and sub-processor information.
ISO 27001 is tracked as preparation, not as a completed certification. We do not claim any certification that is not finished.
DPA, privacy copy, and contractual commitments are public as a working baseline and remain subject to legal review before paid production reliance.
ACN/Garante incident exports are preparation worksheets. Portal-format compatibility will be claimed only after advisor review.
The production database runs on Neon Postgres on AWS eu-central-1 (Neon region aws-eu-central-1).
The app is deployed on Vercel. The latest documented production check observed serverless functions in iad1, and the repository has no custom region override.
The Vercel Blob store for files is private and documented in fra1.
This list covers current production sub-processors for hosting, database, authentication, billing, email, background jobs, and AI assistance. Legal/DPA review is still in progress.
| Provider | Role | Status |
|---|---|---|
| Vercel | hosting, serverless runtime, Blob storage, Web Analytics/Speed Insights after consent | active |
| Neon | Postgres database | active |
| Clerk | authentication, organisations, and user accounts | active |
| Stripe | billing and subscriptions | active for paid plans |
| Resend | transactional email | active / ready depending on environment |
| Inngest | background jobs and scheduled workflows | active |
| OpenAI | questionnaire draft-answer generation when AI is enabled | active by configuration and human review |
Send security reports to security@splnit.eu. Send DPA, sub-processor, and personal data questions to privacy@splnit.eu.