Security and data protection.
This page says what is true for romlet.tech today. Where something is still being set up, it says so.
Hosting
RomLet runs on Railway. The application, its MySQL database and its Redis cache are separate Railway services in the US region. The database and the cache keep their data on persistent Railway volumes.
EU-region hosting is available for pilot sites on request.
Encryption
In transit: every request to romlet.tech is served over TLS through Cloudflare.
At rest: data lives on Railway persistent volumes, which the platform encrypts at rest.
Backups
Database backups are in preparation. We are enabling Railway volume backups for the MySQL service and will state the schedule here once it is confirmed on the service. Until then, do not rely on a backup you have not asked us to confirm.
Access control
Access is role-based: every user has one role, from operator to factory manager, and sees only the modules and records that role allows. Platform roles see metrics only, never case bodies or reporter identities.
An audit log records the acting user, the action, the record, the old and new values, the IP address and the time for audited actions.
GDPR roles and the DPA
The customer plant is the controller of its employees' data. Lintejas Company s.r.o. is the processor and acts on the customer's instructions. A Data Processing Agreement is part of every contract; the draft is published on this site.
Vulnerability reports
Report a security issue to [email protected]. We acknowledge every report within two working days and do not pursue researchers who report in good faith.
What RomLet stores
- Employee name, work email, role, position and department.
- Competency assessments, training records with certificate files, development plans.
- Safety observations, surveys, abnormality reports, permits and lockout or confined-space entries.
- Audit log entries and, for the public contact form, the request itself with a hashed IP address.
- No payroll, bank, health or biometric data fields exist in RomLet.
What we do not do
- We do not sell data, to anyone.
- We do not train AI models on customer data.
- We do not hold payroll or health fields; RomLet has none.
- We do not set tracking cookies on the public site.
Cookies on this site
The public site sets two technical cookies: a session cookie and a CSRF token. They live for two hours, track nothing and are needed for the contact form to work. There is no analytics on this site, so there is no cookie banner. If analytics is ever added, it comes with its own notice and banner first.
Subprocessors
Third parties that process customer data on our behalf.
| Subprocessor | Purpose | Region |
|---|---|---|
| Railway Corporation | Application hosting, database and cache | United States |
| Cloudflare, Inc. | DNS, TLS termination and edge delivery for romlet.tech | Global edge network |
| Email relay | Transactional email (contact-form notices, report delivery). Not yet chosen; to be listed here before use. | — |
Start with one line.
A pilot runs on one production line through a real audit cycle, with a fixed per-site fee agreed before you start.