indifeed Security Policy

Effective date: 4 September 2026

Security is a core part of how we design and operate indifeed.

indifeed is operated by Bit Monkey Ltd.

This document describes our general approach to security and how security researchers can report potential vulnerabilities to us.

1. Security principles

Our security programme is based on the following principles:

• minimise the data we collect and retain;
• provide access only where it is required;
• authenticate access to sensitive systems;
• protect data in transit and at rest where appropriate;
• maintain separation between customer accounts and data;
• keep software and infrastructure maintained and patched;
• record security-relevant activity;
• maintain backups appropriate to the service;
• design systems so that compromise of one component does not automatically compromise the whole service; and
• continuously improve our security controls as the service evolves.

2. Infrastructure security

indifeed production infrastructure and object storage are hosted with Hetzner in Germany and Finland.

We use Cloudflare for DNS, TLS, reverse proxying, content delivery, application/network security and AI inference through Cloudflare Workers AI.

Administrative access to production systems is limited to authorised personnel and systems with a legitimate operational requirement.

We seek to avoid exposing internal services directly to the public internet unless required for operation of the service.

3. Encryption

Connections to indifeed use encrypted transport using current industry-standard protocols.

Sensitive credentials and secrets are not intentionally stored in application source code.

Where appropriate, stored data and infrastructure volumes are encrypted at rest.

Passwords, where used, are not stored in plaintext.

4. Authentication and access control

Access to systems and customer information is restricted according to operational need.

Administrative and production access is separated from ordinary user access wherever reasonably practicable.

We apply appropriate authentication controls to privileged systems and seek to minimise standing administrative privileges.

Customer accounts are logically isolated from one another.

Authenticated web sessions use first-party session cookies configured for security and used solely to provide authenticated application functionality.

5. Software development

Security is considered throughout development and deployment.

Our development practices include, where appropriate:

• source control;
• code review;
• automated testing;
• dependency management;
• automated deployment processes;
• separation between development and production environments;
• controlled management of secrets and configuration; and
• review of security-sensitive changes.

We monitor software dependencies and infrastructure for security issues and apply updates according to the risk they present.

6. Data access

Bit Monkey personnel do not access Customer Content routinely.

Access may occur where reasonably necessary to:

• provide support requested by the Customer;
• investigate a technical problem;
• investigate suspected abuse or a security incident;
• maintain or recover the service; or
• comply with a legal obligation.

Any such access is limited to what is reasonably necessary for the relevant purpose.

7. Monitoring and logging

We use Sentry, configured in its EU region, for production error monitoring and diagnostics.

We configure Sentry to minimise the Personal Data sent to the service and do not intentionally send Customer Content to Sentry.

We also maintain operational and security logging appropriate to the service.

Logs may be used to:

• diagnose faults;
• detect suspicious behaviour;
• investigate security incidents;
• prevent abuse; and
• maintain the reliability of the service.

Access to security and operational logs is restricted.

8. Analytics

We use a self-hosted instance of Umami for anonymous usage analytics.

Umami is operated within infrastructure controlled by Bit Monkey, does not use analytics cookies and is configured not to intentionally collect personally identifiable information.

We do not use advertising or cross-site tracking analytics.

9. AI processing

indifeed may use Cloudflare Workers AI to analyse Customer Content as part of application functionality.

Bit Monkey does not use Customer Content to train general-purpose artificial intelligence models.

As an architectural control, Customer Personal Data must not be sent to a new third-party AI provider without first completing appropriate security and data-protection review and updating the indifeed subprocessor register where required.

10. Backups and recovery

We maintain backups appropriate to the nature of the service and periodically review our ability to recover from system or data loss.

Backups are protected against unauthorised access.

Backup data is removed through normal retention and rotation processes.

11. Security incidents

We maintain procedures for investigating suspected security incidents.

Where an incident affects customer information, we will assess:

• the nature of the incident;
• the information and systems affected;
• the potential consequences;
• actions required to contain and remediate the incident; and
• any notification obligations.

Where required by law or contract, we will notify affected customers or regulators.

12. Third-party providers

We rely on selected third-party providers for some parts of the service.

Where a provider may process or have access to customer information, we consider relevant security and data-protection factors when selecting and managing that provider.

We seek to minimise the amount of customer information made available to third parties.

Our current subprocessor list is available at https://indifeed.dev/legal/subprocessors.

13. Customer responsibilities

Security is a shared responsibility.

Customers are responsible for:

• protecting their accounts and authentication credentials;
• maintaining appropriate access to their workspace;
• removing access when users no longer require it;
• securing systems that integrate with indifeed;
• protecting API keys and other credentials;
• configuring integrations appropriately; and
• notifying us promptly if they suspect unauthorised access.

14. Vulnerability disclosure

We welcome responsible reports from security researchers.

If you believe you have found a security vulnerability in indifeed, please contact:

[email protected]

You can encrypt sensitive reports with our public PGP key. Download the PGP public key.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaqpm7hYJKwYBBAHaRw8BAQdAfN5vsZanFNZKiTQ3c+6bHYSPcmSEmsgyHZrE
kiW7GMG0LEJpdCBNb25rZXkgU2VjdXJpdHkgPHNlY3VyaXR5QGJpdC1tb25rZXku
aW8+iLUEExYKAF0WIQSHlGJh6d6XlfGJAZUbsnaAlkRspAUCaqpm7hsUgAAAAAAE
AA5tYW51MiwyLjUrMS4xMiwwLDMCGwMFCQHhM4AFCwkIBwICIgIGFQoJCAsCBBYC
AwECHgcCF4AACgkQG7J2gJZEbKRYhgEA4LtRjYAPajP3yfMU8AUcrvFw0GtY4iPt
wxtOEY6xVtsBAIUfOA91Gi9hkeTLXGlcmzb7dEREOLUbCwOqsbf22/oOuDgEaqpm
7hIKKwYBBAGXVQEFAQEHQHzDPGVSE/i4XyBuJ3Ve6w2Yzw0mABTHntH74SduefBV
AwEIB4iUBBgWCgA8FiEEh5RiYenel5XxiQGVG7J2gJZEbKQFAmqqZu4bFIAAAAAA
BAAObWFudTIsMi41KzEuMTIsMCwzAhsMAAoJEBuydoCWRGykJR8A/RzhXKuyvkKn
UXN8MTEYt31aeWgaCHry8zWMFPckdLl/AQDWar7pXEpo+ZdcyKB8ss+lterAmnxs
JzXxn6GISjFWCA==
=WT6k
-----END PGP PUBLIC KEY BLOCK-----

Please include enough information for us to understand and reproduce the issue, including where appropriate:

• the affected service or endpoint;
• the nature of the vulnerability;
• steps required to reproduce it;
• the likely impact; and
• any supporting evidence.

Please do not include unnecessary personal information or customer data.

15. Responsible research

When investigating a potential vulnerability, please:

• make a good-faith effort to avoid accessing data belonging to other users;
• stop testing if you gain unintended access to customer or confidential information;
• do not modify, destroy, download or retain customer information;
• do not disrupt the service;
• do not perform denial-of-service testing;
• do not use social engineering, phishing or physical attacks;
• do not attempt to extort payment or threaten disclosure; and
• give us a reasonable opportunity to investigate and address the issue before publishing it.

If you accidentally encounter customer information, tell us what happened and delete any copies you may have created.

16. Our commitment to security researchers

Where you conduct security research in good faith and follow this policy, we will:

• treat your report seriously;
• investigate it as appropriate;
• make reasonable efforts to communicate with you about material findings;
• not pursue legal action against you solely for research conducted in accordance with this policy; and
• where appropriate, acknowledge your contribution if you would like us to do so.

This policy does not authorise activity that would otherwise harm our customers, users or infrastructure.

17. Security information and questionnaires

Business customers requiring additional information about our security practices may contact [email protected].

We will provide additional information where appropriate, subject to confidentiality and security considerations.

18. Changes

We will update this Security Policy as our systems and security practices evolve.

The effective date at the top indicates when this policy was last materially updated.

19. Contact

Bit Monkey Ltd
Company number: 17306463
132a High Street
Bromsgrove
United Kingdom
B61 8ES

Security reports: [email protected]
Privacy enquiries: [email protected]