Data Storage & Security

This page describes how Totalum actually operates. It is written to match our Privacy Policy, our Data Processing Addendum and our Sub-processor list. When those documents and this page disagree, the legal documents govern.

#Where your data lives

• 🇪🇺 Primary hosting in the European Union. Your project databases, the build sandboxes where the AI agent works, and Totalum's own application databases run on virtual machines in datacenters located in the European Union.
• 🌐 Published apps are served from Cloudflare's global network. When you publish, your app is deployed to Cloudflare Workers and served from the edge location closest to each visitor, worldwide. Cloudflare also provides TLS, DDoS protection and CDN caching.
• 🗄️ Files and logs are stored in Google Cloud Storage. Uploads you attach to prompts, project archives and agent execution logs are stored in Google Cloud Storage.
• 🤖 AI processing happens with US model providers. Your prompts, your project's source code and the agent's conversation are sent to Anthropic (Claude) to generate code, and voice input is transcribed by OpenAI (Whisper). Neither provider uses your data to train their models under the commercial terms we hold with them.

Because some of these providers process data in the United States, we do not claim that your data never leaves Europe. Transfers out of the EEA/UK are covered by Standard Contractual Clauses or the EU-US Data Privacy Framework, as described in the Privacy Policy and the DPA.

#Infrastructure certifications

Our datacenter provider for databases and sandboxes holds:

• ✅ ISO 9001 — Quality Management Systems (held by the datacenter provider)
• ✅ ISO 27001 — Information Security Management (held by the datacenter provider)
• ✅ Physical security — access-controlled facilities with redundant power and network

These certifications belong to our infrastructure providers, not to Totalum, Inc. itself. Totalum does not currently hold its own ISO 27001 or SOC 2 certification. If you need provider certificates or a security questionnaire for your own compliance process, contact contacto@totalum.app.

#Security features

#Encryption

• Encryption in transit — HTTPS/TLS for every connection between your browser, our services, and our providers.
• Encryption at rest — disk-level encryption on our database and storage providers.

#Isolation and access control

• One database per project organization — each project's data lives in its own MongoDB database, not in shared tables.
• Isolated build sandboxes — the AI agent works in a dedicated virtual machine per project. Sandboxes are archived after 6 hours of inactivity and destroyed after 2 days; a static preview of your published app stays online.
• Team roles — the account owner controls who can access each project.
• API keys — scoped, revocable keys for programmatic access; every key is revoked immediately when an account is closed.
• Logging — access and agent activity are logged for security, abuse prevention and support.

#Backups

• Automated backups of Totalum's databases on a regular schedule.
• Your own copies — you can export your source code at any time (ZIP download or GitHub sync on paid plans) and export your database. We recommend keeping your own backups of anything critical; Totalum's backups exist for disaster recovery, not as a versioned archive you can restore on demand.

#Availability

• Cloudflare edge delivery for published apps, with DDoS protection and caching.
• No uptime guarantee on standard plans. A contractual SLA is available on Enterprise agreements only.

#Data ownership

You own your data and your code:

• ✅ Export anytime — download your complete source code and export your database.
• ✅ No lock-in — standard Next.js code and standard MongoDB data.
• ✅ Portability after termination — export remains available for 30 days after your account or project ends, as set out in the Terms of Service.
• ✅ Delete anytime — deleting a project permanently removes its code, database and live URL.

#Privacy commitments

• 🔒 We do not sell your data, and we do not use your prompts, code or project data to train AI models.
• 🔒 Your project data is shared only with the sub-processors we need to run the service (listed here), under contracts that limit what they can do with it.
• 🔒 We do not track the visitors of your published apps. Totalum sets no cookies and loads no analytics on the sites you publish. The only thing we inject is the "Made with Totalum" badge on free-plan sites, which contains no tracking. Infrastructure usage (requests, CPU, database operations, storage) is metered for billing.
• 📣 Our own marketing site uses advertising tags (Google, Meta, Reddit) subject to your cookie choices, as described in the Cookie Policy. That is about visitors to totalum.app, not about the data inside your projects.

#Your responsibilities

The apps you build and publish are yours. You are responsible for their security (secrets, authentication, input validation), for the privacy notice and cookie consent they show to their own users, and for the lawfulness of the data you put in them. Our Acceptable Use Policy and the Data Processing Addendum set out the split of responsibilities.

#Questions?

If you have questions about data storage, security, or compliance, or want to report a vulnerability, contact us at contacto@totalum.app.