Security Overview

Version 1.0

Last Updated: July 19, 2026

Purpose

This Security Overview provides a high-level description of the security architecture, operational practices and technical safeguards implemented by SetRoasFlow.

The purpose of this document is to help Merchants understand how the platform is designed to protect Merchant Customer Data while delivering reliable server-side data collection and routing.

This document is informational only and does not create contractual obligations beyond those contained in the Terms of Service or the Data Processing Addendum.

Security Philosophy

Security is considered throughout the lifecycle of the platform rather than being implemented as a separate layer.

SetRoasFlow follows principles including:

• Privacy by Design
• Security by Default
• Least Privilege
• Defense in Depth
• Data Minimization
• Secure Defaults
• Fail-Closed Processing
• Continuous Improvement

Security controls are periodically reviewed as the platform evolves.

Platform Architecture

SetRoasFlow is built around a distributed cloud-native architecture designed to minimize latency while maintaining strong security controls.

Primary components include:

• Cloudflare Workers
• Cloudflare D1
• Cloudflare Durable Objects
• Supabase
• Next.js Dashboard

Each component performs a narrowly defined role and receives only the permissions required for its function.

Authentication

Merchant authentication is handled through secure authentication mechanisms.

Authentication controls include:

• encrypted credential transmission
• secure session management
• authenticated dashboard access
• server-side authorization checks
• session expiration where appropriate

Passwords are never stored in plaintext.

Authorization

Access to platform resources is controlled using authorization rules based on the authenticated Merchant.

Merchants may access only resources belonging to their own account.

Administrative access is limited to authorized operational purposes.

Encryption

Data transmitted between users, Connected Properties and SetRoasFlow is protected using encrypted communications.

Encryption is applied during transmission using industry-standard TLS.

Where supported by the underlying infrastructure, data stored by platform services is additionally protected through storage-level encryption mechanisms.

Secret Management

Sensitive credentials including API keys, webhook secrets and platform secrets are stored using secure secret management mechanisms.

Secrets are:

• not hardcoded into application code;
• accessible only by authorized runtime environments;
• rotated when operationally necessary;
• protected from unauthorized disclosure.

Identity Resolution

Identity Resolution is performed using information supplied by the Merchant through supported Collection Methods.

Where supported by the configured workflow:

• identifiers may be normalized;
• duplicate profiles may be resolved;
• hashed identifiers may be generated before transmission to supported Destinations.

Identity Resolution is performed solely on behalf of the Merchant.

Hash-first Processing

Where applicable, identifiers are transformed using SHA-256 hashing before transmission to supported advertising platforms.

Hashing reduces exposure of raw identifiers during outbound processing.

Hashed identifiers continue to be treated as Personal Data where required by applicable privacy laws.

Consent-aware Processing

SetRoasFlow is designed to support Merchant-defined consent preferences.

Depending on the Merchant configuration and applicable regional requirements, the platform may:

• suppress identifiers;
• disable destination delivery;
• prevent event dispatch;
• apply destination-specific privacy parameters;
• enforce geo-aware routing decisions.

The Merchant remains responsible for obtaining valid consent where required by law.

Infrastructure Security

Infrastructure providers are selected based on reliability, operational maturity and security capabilities.

Security features include:

• globally distributed edge infrastructure;
• network isolation where applicable;
• infrastructure monitoring;
• denial-of-service protections;
• secure database services;
• managed platform services.

Logging

Operational logging is used to:

• diagnose failures;
• investigate incidents;
• monitor platform health;
• improve operational reliability.

Logs are retained only for legitimate operational and security purposes.

Sensitive information is minimized wherever reasonably possible.

Monitoring

Platform health is continuously monitored to detect:

• service degradation;
• infrastructure failures;
• abnormal processing;
• operational anomalies;
• security-related events.

Monitoring is intended to support rapid identification and remediation of operational issues.

Incident Response

SetRoasFlow maintains procedures for identifying, investigating and responding to security incidents.

Incident response activities include:

• detection;
• containment;
• investigation;
• remediation;
• recovery;
• post-incident review.

Where Merchant Customer Data is affected, notifications are provided in accordance with applicable law and contractual obligations.

Business Continuity

Infrastructure is designed to support operational continuity through:

• cloud-native deployment;
• redundant infrastructure where supported;
• managed database services;
• backup procedures;
• disaster recovery planning.

Backup Strategy

Operational backups are maintained to support disaster recovery.

Backup data is:

• protected using infrastructure security controls;
• retained according to operational requirements;
• inaccessible to Merchants;
• deleted through normal backup rotation schedules.

Access Control

Administrative access is restricted according to the principle of least privilege.

Access rights are granted only where operationally necessary.

Administrative activities may be logged for security purposes.

Vulnerability Management

Security vulnerabilities are evaluated according to their potential impact.

Where appropriate, remediation may include:

• software updates;
• dependency updates;
• infrastructure changes;
• configuration changes;
• temporary mitigations.

Critical vulnerabilities receive priority handling.

Third-party Services

SetRoasFlow relies on carefully selected infrastructure providers.

These providers are listed separately within the Subprocessors List.

Merchant-selected Destinations are not considered infrastructure subprocessors.

Merchant Responsibilities

Merchants remain responsible for:

• securing their own accounts;
• protecting API credentials;
• configuring integrations appropriately;
• obtaining required consent;
• complying with applicable privacy laws.

Platform security cannot compensate for insecure Merchant configurations.

Continuous Improvement

Security practices evolve continuously as:

• infrastructure changes;
• new threats emerge;
• regulations evolve;
• new platform capabilities are introduced.

SetRoasFlow may improve security controls without prior notice where necessary to maintain the security of the Services.

Contact

Security-related inquiries may be directed to:

Operator

Matteo De Giuseppe

Italy

Email

[email protected]

Version History

End of Security Overview