In the browser
What reaches our servers
Only the features that have to run on a server send us a document, and each keeps it no longer than it needs:
- The URL tab fetches the document through our server, which passes it on to your browser without storing it.
- The API keeps a document and its schema until the validation finishes, 24 hours at most if something fails; the result, 24 hours.
- URL monitors download, validate and discard the document; the outcome and the first error are kept for 30 days.
- Report links store the report you share (findings, not the document) for 30 days.
- Saved schemas stay in your account until you delete them.
The full list, with everything we log, is in the privacy policy.
Where data lives
Everything we store is kept in the European Union:
- the application, the database (PostgreSQL) and the queues (Redis) run on Hetzner servers in Falkenstein, Germany;
- saved schemas, temporary files and database backups are in Cloudflare R2 under its EU jurisdiction, which keeps the data in EU data centres;
- error reports go to Sentry in Frankfurt, and emails are sent through Mailgun's EU region.
Traffic passes through Cloudflare's network, which terminates TLS at the data centre nearest to you. Payments are handled by Paddle, and Google Analytics counts visits; neither receives documents or API data.
How it is protected
- The site and the API are served over HTTPS only.
- Files in Cloudflare R2 are encrypted at rest.
- Passwords are stored as bcrypt hashes; API keys as hashes too, so a key can't be read back from the database.
- Card details never reach us: Paddle collects them as the merchant of record.
- The engine reads only the files of the validation it runs, with network access off, and the URL fetcher reaches public addresses only.
- Shared reports are served with a strict Content Security Policy and kept out of search engines.
- Each account sees only its own validations, schemas, monitors and keys.
Subprocessors
The services that process personal data for us:
| Service | Purpose | Location |
|---|---|---|
| Hetzner Online | Application servers, database (PostgreSQL) and queues (Redis) | Falkenstein, Germany |
| Cloudflare | Network delivery and protection from attacks; R2 storage for saved schemas, temporary files and database backups | R2 storage: EU jurisdiction. Edge network: worldwide, nearest to the visitor |
| Mailgun | Account and monitor emails | EU region |
| Sentry | Error reports | Frankfurt, Germany |
| Paddle | Payments for the Pro plan, as the merchant of record | United Kingdom |
| Google Analytics | Aggregate traffic statistics; in the EEA, the UK and Switzerland only with the visitor's consent. Never receives documents or API data | United States |
Paddle and Google Analytics act on their own account and never see the data you send us; the DPA covers the others. We announce a new subprocessor here 30 days before it starts.
DPA and transfers
xmlvalid is operated by Oleksii Babintsev, a sole proprietor (FOP) registered in Ukraine. The data stays in the EU, but it is managed from Ukraine, and the European Commission has not taken an adequacy decision for Ukraine. Our data processing agreement therefore includes the EU Standard Contractual Clauses (controller to processor), with the UK and Swiss additions.
The DPA is part of the terms of service and applies without signing. If your procurement needs a signed copy, write to support@xmlvalid.com.
Reporting a vulnerability
If you find a security problem, write to support@xmlvalid.com with the steps to reproduce it. We reply within two working days and will tell you when it is fixed. Please don't access other people's data, degrade the service or make the problem public before it is fixed. The same address is in our security.txt.