Security & trust

Where Dolphwin runs

• The service and its database run on Fly.io in Ashburn, Virginia (United States). The data disk is encrypted at rest.
• Every connection uses HTTPS. Plain HTTP is redirected, and browsers are told to use HTTPS only (HSTS).
• Pages are served with strict browser protections: they can't be framed by other sites, file types can't be guessed, and the camera, microphone, location and payment features of your browser are switched off for Dolphwin.

Access to your account

• No passwords to steal. You sign in with a link or a 6-digit code we email you. A link works once, for 15 minutes; a code allows 5 tries.
• Keys are stored as fingerprints. Browser sessions and API keys for your AI agents are kept only as one-way hashes, so a copy of our database would not let anyone sign in as you.
• A signed-in browser stays signed in for up to 90 days. You can sign out every browser at once from your account page.
• Your account sees only its own searches, watchlist, lists, reports and requests. This is checked on every request, and covered by automated tests.

What we keep, and what we don't

• About you: your organization's name and website, your name and work email, and what you told us you use Dolphwin for.
• Your activity: the companies you search and watch, and each answer you received, saved with the official record it came from. This is your audit trail: you can reopen any answer later, exactly as you saw it.
• We don't ask for government ID numbers, and we don't sell your data or show your searches to other customers.
• Payments are handled by Stripe. Card numbers go to Stripe directly and never reach Dolphwin's servers.
• Dolphwin searches companies, not people. It shows a person only in the role an official record gives them, never a home address or phone number.

The details, including how long we keep things and how to ask for a copy or deletion, are in the Privacy Policy.

Backups and recovery

• The database is copied every night. A copy stays on the server for 14 days, and every copy is also uploaded to separate storage with a different provider (Cloudflare), encrypted at rest.
• We test recovery: the newest off-site copy is downloaded, opened and checked against the live data.

Monitoring

• Independent uptime checks every 5 minutes, from outside our hosting provider, alert us when the site or its health check stops answering.
• The service checks its own database, disk and nightly jobs, and emails us when something isn't right.

How we build and change Dolphwin

• Every change runs our automated test suite, more than 500 tests, before it can be released.
• The software libraries Dolphwin depends on are pinned to exact versions and checked against public databases of known vulnerabilities on every change, and again every week.
• Before opening to customers, Dolphwin's code went through a dedicated security review. Every high-severity finding was fixed before launch.

Companies that help us run Dolphwin

What we don't have yet

• Dolphwin is not SOC 2 audited yet. If your security team sends a questionnaire, we'll answer it in full.
• Single sign-on (SAML) is planned for Enterprise accounts. Tell us if you need it.

Report a security problem