Trust and security
Where your data lives, and who can reach it.
For the person who has to sign off: where records are stored, who processes them, what is automated, what a person approves, and what we do not claim.
What runs today, and how it is bounded.
The service runs on Netlify. Its records are held in a Neon Postgres database provisioned for this venture alone, not a shared multi-tenant store. Traffic between a browser and the service is encrypted in transit.
The providers that process data
Personal data is handled by a fixed set of named providers and no others: Netlify for hosting and delivery, Neon for the database, Resend for transactional email, Plausible Analytics for usage measurement, and Cloudflare for anti-abuse verification. That list is published, not furnished on request.
Cookie consent is enforced per category. Usage measurement is cookieless, identifies nobody, and loads only after consent is given. No advertising or cross-site tracking cookies are set.
Abuse prevention without profiling
Public forms are screened by Cloudflare Turnstile, which distinguishes a person from a bot without profiling the visitor.
What we can prove, and what we cannot yet.
A security reviewer is looking for specifics, and vagueness reads as absence. So here is the plain account of what runs, where it runs, and who can reach it. Subchain is pre-launch. What is live today is this website and the records behind it — not a deployed contracting runtime — and this page describes the posture of what actually exists rather than what is planned.
What exists today
The site runs on Netlify, and its records sit in a Neon Postgres database provisioned for this venture alone rather than a shared multi-tenant store. Connections between a browser and the service are encrypted while they travel. Personal data is handled by a fixed set of named providers — Netlify, Neon, Resend, Plausible Analytics and Cloudflare — and by no others; that list is published rather than supplied on request, so you can check it before you engage. Usage measurement is cookieless and identifies nobody, consent is enforced by category, and no advertising or cross-site tracking cookies are set. Public forms are screened by Cloudflare Turnstile, which separates a person from a bot without profiling the visitor. What we collect and why is set out in the Privacy Policy, and how we treat cookies is set out in the Cookie Policy.
What we do not claim
An honest absence is worth more to a reviewer than a vague assurance, so we are direct about what we do not hold. Subchain holds no SOC 2, ISO 27001 or other certification: a badge is earned through an audit we have not undertaken, and we will not template one. No independent security audit or penetration test has been completed. We publish no uptime figure and offer no availability guarantee or service-level commitment, because none exists on the record and stating one would misrepresent the number a buyer relies on most. We run no paid programme that rewards disclosure. There is no separate security team to name; the venture is early, and accountability sits with its named human governors. What exists instead is a published route for reporting a vulnerability — with scope, a definition of good-faith research, and what a reporter can expect back — alongside the concrete controls set out above.
Automation, approval and record
Where a reviewer asks what our agents will do without a person: by design, they will not commit. The Subchain runtime lets agents propose and counter machine-readable terms, but no agreement binds until a named human clears the approval gate, and every proposal, revision, approval and acceptance is recorded. That is the governance model the product is built around. It is design intent for a runtime not yet in customers' hands, and we describe it as such rather than as a live control you can inspect today. When the runtime reaches customers, this page will describe its controls with the same specificity it describes the website now.
The questions a review actually asks.
Put your security questions to a named person.
If your review needs detail this page does not cover, ask. A named human owns the answer.