Privacy and data handling
What PostDeploy stores, where it stores it, how long it keeps it, and what it removes before storage.
Who is responsible
ALPLUS TECHNOLOGIES SRL, registered in Romania, is the controller for the data described on this page. Write to hello@alplustech.com with any question about your data.
What PostDeploy stores
- Your account: your email address, an optional name, and a hash of your password.
- Error events that your application sends: messages, stack traces, breadcrumbs and any context your code attaches. If your code attaches personal data to an error, PostDeploy stores it.
- Structured logs that your application sends, with their attributes.
- Deployments that you or your CI record.
- Source maps that you upload and reports that you or your agents publish.
- Notification settings: which members get email notifications, and the webhook URLs you add with their signing secrets. Full webhook URLs and secrets are stored encrypted. The host of each URL is stored in plain text to label it.
- Invitations: the invited email address and role.
- OAuth clients that agents register: the client name, its redirect URLs and the scopes it requests.
- Billing records from Stripe: the customer and subscription identifiers and the paid periods. Stripe processes payments. PostDeploy does not store card details.
What PostDeploy removes before storage
Built-in redaction runs before anything is stored. It replaces the values of credential fields, such as passwords, tokens, cookies, authorization headers and API keys, with [Filtered]. It also filters credentials in URLs and in common text patterns. Owners and admins can add more field names on the Data controls page.
Redaction does not find other personal data in free text, such as names or addresses in a log message. Keep that data out of what your application sends.
Where data is stored
PostDeploy runs on Cloudflare Workers. Each organization has isolated SQLite storage in a Durable Object. Error payloads, archived log batches, uploaded source maps, the content of published reports and backup sets are stored in Cloudflare R2.
Archived log batches are encrypted before storage in R2. Backup sets are encrypted before they are written to R2.
Email and webhooks
PostDeploy sends account email (address confirmation, password reset and invitations), usage alerts, and issue and report notifications through an email delivery provider. The provider receives each recipient address and the message content.
Webhook notifications are sent to the URLs you add.
How long data is kept
Errors are kept 90 days and logs 90 days from the time PostDeploy receives them. A scheduled job deletes expired data.
An owner can delete an organization. PostDeploy then deletes its database, its stored errors and logs, and its API keys.
Stored error and log data follows the retention periods above. Cloudflare provides the storage infrastructure.
Cookies and scripts
PostDeploy sets cookies to keep you signed in and to protect its forms. It sets no advertising or analytics cookies.
The public site and the dashboard load no third-party analytics, advertising or session-replay scripts. The sign-up, sign-in and password reset pages can load Cloudflare Turnstile to block automated requests.
What this page does not claim
PostDeploy holds no SOC 2 report and no ISO certification, and has not commissioned an external penetration test.
One person operates PostDeploy. Consider that when you decide what to depend on it for.