Security
Transport and storage
All traffic to petreldata.io, the hazard API, and the billing service is served exclusively over TLS. Data products are distributed through CloudFront with origin-access-controlled S3 — buckets are not directly public. Application infrastructure runs on AWS (us-east-1) behind a managed load balancer.
Credentials
API key secrets are stored as salted bcrypt hashes — we cannot recover a key after issuance, only rotate it. Keys can be rotated or revoked instantly from your account. Sign-in is delegated to Firebase Authentication; Petrel never stores passwords. Service secrets are held in AWS Secrets Manager, not in code or images.
Payments
Payments are processed by Stripe, a PCI-DSS Level 1 service provider. Card data is entered on Stripe-hosted surfaces and never transits or rests on Petrel systems. Stripe webhook deliveries are signature-verified and processed idempotently.
Data integrity
Hazard products are versioned, immutable vintages — every release ships with checksums, STAC metadata, per-pixel uncertainty, and input-coverage masks, so you can always identify exactly which data version an analysis used.
Subprocessors
We use a small set of vetted subprocessors: Google Firebase (authentication), Stripe (payments), Amazon Web Services (hosting and delivery), Resend (transactional email), MapTiler (demo geocoding), and Plausible (cookieless analytics). The current list and the data each handles are described in our Privacy Policy.
Incident response
We monitor for unauthorized access and maintain an incident-response process. In the event of a personal-data breach affecting you, we will notify affected customers and, where required, the relevant supervisory authority without undue delay and consistent with applicable law (including GDPR breach-notification timelines).
Accessibility
We aim to make petreldata.io usable by everyone and design toward the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, in line with the spirit of the Americans with Disabilities Act and the European Accessibility Act. Accessibility is an ongoing effort; if you encounter a barrier or need an accommodation, email petreldata.io@gmail.com and we will work to provide the information or function you need.
Reporting a vulnerability
If you believe you have found a security issue in any Petrel service, email petreldata.io@gmail.com with details. We commit to acknowledging reports within two business days. Please do not test against other customers' data or degrade the service while researching.