Trust center
What we have built, and what we have not.
Controls with evidence, subprocessors by function, documents and how to reach us about security.
Moatgator is in private beta and holds no security certification. This page says what exists in the product's code, what is planned and what is still undecided.
Subprocessors
Only the subprocessors marked “In use” process customer data. Customers are told at least 30 days before one is added or replaced.
| Function | Provider | Data | Region | Status |
|---|---|---|---|---|
| Cloud hosting and database (API, console, workers, PostgreSQL) | Railway | All platform data: accounts, Telemetry, Attest verdicts, audit trail, billing records | United States (California) | In use |
| File storage (S3-compatible bucket) for Scan packages and build artifacts | Railway (Buckets) | App packages sent for analysis (deleted within 24 hours) and protected builds | United States | In use |
| Transactional e-mail (verification, security, alerts, billing) | Resend | Recipient address and message content | United States | In use |
| DNS for moatgator.com | Amazon Web Services (Route 53) | No customer data: only DNS queries for our domains | Global | In use |
| Code hosting and integrations: sign-in with GitHub, GitHub App (Solve pull requests), CI identity (OIDC) | GitHub (Microsoft)Only for users and organizations that connect GitHub | GitHub account id, e-mail and organizations; content of the repositories the customer authorizes | United States | In use |
| Android integrity verification (Attest) | Google (Play Integrity API)Only for apps whose customer configures Android Attest, using the customer's own Google Cloud service account | The encrypted integrity token generated on the device | Global | In use |
| Optional sign-in with Google or X | Google, X Corp.Only when the person chooses that sign-in method | Account identifier and verified e-mail returned by the provider | United States | In use |
| Payments and invoicing (card and Pix) | Stripe | Billing contact, tax ID and payment details (card data stays with the provider) | Brazil and United States | Planned |
| Error monitoring | Sentry | Technical error details; IP addresses and e-mails are scrubbed before sending | United States | Planned |
| AI investigation in the console and docs assistant | AnthropicConsole: only for organizations that opt in. Docs: only the question typed by the visitor | Aggregated or pseudonymized excerpts of Telemetry, with no device hash, IP or e-mail; docs questions with IPs and e-mails removed | United States | Planned |
| Encrypted off-site backups | Cloudflare R2 or Backblaze B2 (to be chosen) | Database dumps encrypted before upload (the provider cannot read them) | To be defined | Evaluating |
| Bot protection on public forms (optional) | Cloudflare Turnstile | Browser signals needed to tell people from bots | Global | Evaluating |
Documents
- Terms of servicePublished
- Privacy noticePublished
- Data processing agreement (DPA)Published
- SubprocessorsPublished
- Acceptable use policyPublished
- Enterprise SLAPublished
- Vulnerability disclosure policyPublished
- Cookie policyPublished
Responsible disclosure
If you believe you found a vulnerability or a bypass, follow our disclosure policy: scope, safe harbor and timelines are there. The policy and contact are also published as security.txt (RFC 9116). We publish a fix only after it is available and with the reporter's consent.
Security contact
Start the message with [SECURITY]. Our security@ mailbox does not receive mail yet, so use the form.
Reports
No third-party penetration test report exists yet, so none is published. When one exists, it will be listed here.