Security & architecture

Where your data runs

The DROP Ops agent runs entirely inside your environment. Your DROP API key, your consumer records, and the state's deletion lists are read, matched, and processed on your machines. None of them are transmitted to us — not at signup, not during cycles, not in error reports. The agent is a single Go binary with no external dependencies, and it completes compliance cycles fully offline: if this dashboard is unreachable, your cycles still run.

What the dashboard stores

Your account (email, company name, password hash — bcrypt), your license keys, billing state from Stripe (plan, subscription status; card data never touches our servers — it goes directly to Stripe), and agent heartbeats. A heartbeat contains exactly: agent version, cycle status, cycle timestamp, and seven integer counts (work items, deleted, exempted, opted out, not found, pending status amendments, re-acquired consumers).

What we never store: consumer identifiers, consumer emails or phone numbers, hashes of any of these, deletion-list contents, or your DROP API key. This is enforced in code, not just policy — the heartbeat endpoint validates against a strict schema and hard-rejects any payload containing fields beyond the ten listed above, and the license-verification response is limited to four non-identifying fields.

Tamper-evident evidence log

Every cycle step — list download, match, worklist generation, status upload — is appended to an evidence log on your machine. Each entry includes a SHA-256 hash of the previous entry, forming a hash chain: altering or deleting any historical entry breaks verification of every entry after it. dropagent verify checks the full chain. The log stays in your environment; we never receive it.

Hosting

The dashboard runs on Vercel (serverless functions in iad1 — Washington D.C., US East) with its database on Neon managed Postgres in AWS us-east-2 (Ohio). Payments are processed by Stripe. The dashboard is served at dropopscompliance.com, TLS-only with HSTS. Our test and staging environments contain only synthetic fixture data — customer records never leave the production database.

Contact

Security questions, disclosure reports, or anything else: support@dropopscompliance.com. We answer within 2 business days.

What we don't claim

We are an early-stage product and do not currently hold SOC 2, ISO 27001, or similar certifications, and we won't imply otherwise. The strongest guarantee we offer is architectural: the sensitive data never leaves your environment, so the dashboard's blast radius is limited to account metadata and operational counts.