SunLicense

Security ​

Last updated: 14 October 2026

SunLicense protects the software you sell, so we treat the security of the Service as part of the product. This page describes the measures in place today. It is also Annex II (technical and organizational measures) of the Data processing addendum.

Isolation between organizations ​

  • Every record that belongs to an organization carries its organization ID, and every query is scoped to the caller's organization by the data layer, not by individual endpoints.
  • An automated cross-tenant isolation test suite runs on every change and blocks the release if one organization can read or change another's data.
  • Each service owns its own database. Services exchange events, not database access.

Access control ​

  • Every API request passes through a single gateway that checks the caller's permissions. Routes without an explicit rule are denied by default.
  • Roles (Owner, Admin, Developer, Support, Viewer and custom roles) limit what each staff member can do. Role changes and disabled accounts take effect within 30 seconds, even for signed-in sessions.
  • Dashboard sessions expire after at most 12 hours.
  • SunLicense staff use separate administrator accounts that cannot act inside a customer organization's dashboard or API.

Credentials and keys ​

  • Passwords are hashed with bcrypt. API keys are stored as SHA-256 hashes and shown in full only once, when created.
  • License keys are masked in the dashboard by default and revealed only on request.
  • Offline license files are signed with an Ed25519 key, and your software verifies them with the public key.

Data protection ​

  • All traffic to SunLicense domains is encrypted in transit with TLS, both between users and Cloudflare and between Cloudflare and our servers.
  • We collect the minimum needed: validation calls are stored with approximate location only, never with IP addresses.
  • Databases and the message broker are reachable only from inside our private network, never from the internet.
  • Retention and deletion follow the Data retention policy.

Operations ​

  • Every change is tested automatically (unit, integration and end-to-end tests) before it is deployed.
  • Releases are built as container images and deployed with short-lived credentials; no long-lived deployment secrets are stored on servers.
  • Production secrets are kept only on the production server, with restricted file permissions.
  • Access to production is limited to the SunDevs engineers who run it, with individual SSH keys.
  • Uptime and the health of each internal service are monitored publicly at status.sunlicense.com.

Incident response ​

If we become aware of a security incident affecting your data, we contain it, investigate, and notify affected customers without undue delay, and within 72 hours for personal data breaches, as set out in the Data processing addendum.

Certifications ​

SunLicense is in open alpha and does not yet hold certifications such as SOC 2 or ISO 27001. We are happy to answer security questionnaires: email [email protected].

Reporting a vulnerability ​

If you find a security issue in SunLicense or the official SDKs, please email [email protected] with "Security" in the subject, including steps to reproduce. We will acknowledge your report within 3 business days, keep you updated, and credit you if you wish once it is fixed.

Please act in good faith: test only against your own organization, don't access or modify other people's data, don't run denial-of-service or automated high-volume tests, and give us reasonable time to fix the issue before telling others. We will not take legal action against research done in line with these rules.