Data Handling Statement

Effective Date: May 28, 2026

This statement explains where StationForge stores your data and who can access it.

Where Your Data Is Stored:

• Database: Supabase PostgreSQL, hosted in the United States (AWS us-east-1)
• Files and documents: Cloudflare R2, United States region
• All data is encrypted at rest (AES-256) and in transit (TLS 1.2+)

Who Can Access Your Data:

• Your department's users, subject to their assigned role and permissions
• StationForge personnel, for the sole purpose of providing technical support and operating the service
• The following sub-processors have limited, scoped access:
• Supabase — database infrastructure only
• Cloudflare — file storage infrastructure only
• Resend — email delivery (email address and email content only)
• Sentry — error monitoring (anonymized error stack traces only)

What We Do Not Do:

• We do not sell, rent, or license your data to any third party
• We do not use your department's operational data for any purpose other than running the service
• We do not perform analytics or machine learning on your department's data

Backups:

• Automated daily database backups are retained for 7 days
• File storage is replicated across Cloudflare's infrastructure

Data Deletion:

Upon account closure, all department data is deleted within 30 days upon written request to [email protected]