1. Infrastructure
All production systems run in EU data centres, operated by Hetzner (Germany). The website runs on servers operated by Namecheap (Netherlands). Systems are isolated by environment (production / staging / development) and access is restricted to a small on-call team.
2. Encryption
- Data in transit: TLS 1.3 enforced on every endpoint.
- Data at rest: database storage is encrypted at rest with AES-256.
3. Application security
- Dependencies scanned daily for known CVEs.
- Static and dynamic analysis runs on every pull request.
- Browser extension follows the Manifest V3 least-privilege model.
4. Reporting a vulnerability
If you believe you've found a security issue, please write to security@trackbee.co. We aim to acknowledge reports within 1 working day. We do not currently run a paid bug-bounty programme, but we publicly credit responsible reporters who request it.