Our Security Commitments
DistantRace is engineered with privacy-by-design and rigorous European compliance.
Hosted in the European Union
All servers, PostgreSQL databases, and backups reside strictly in EU data centers (Germany & Finland) powered by 100% renewable hydropower.
CASA AL1 Assessed
Independent assessment by TAC Security marked In Compliance under Cloud Application Security Assessment (CASA) Tier 1.
Strict GDPR Compliance
Headquartered in Latvia (EU). Full data protection agreements, data minimization, and automated Right to Erasure workflows.
End-to-End Encryption
Strict TLS 1.3 in transit and AES-256 at rest, paired with client-side age-encrypted streaming database backups.
Looking for our compliance documents?
Review public policies or request access to restricted audit reports.
Security & Compliance Controls
Real-time visibility into the operational and technical controls protecting DistantRace platforms and infrastructure.
Cloud Application Security Assessment (CASA AL1)
The application architecture, OAuth flows, and Google Health API integrations have undergone independent security review by authorized assessor TAC Security under CASA Tier 1 and are marked 'In Compliance'.
Automated Fail-Closed Dependency Vulnerability Scanning
Every CI/CD commit undergoes automated dependency vulnerability scanning using Trivy on locked dependency manifests (poetry.lock and package-lock.json) with custom fail-closed verification (verify_fail_closed_scan.py).
Multi-Architecture Container Image Vulnerability Scanning
All production container images (scan_django_production, scan_nginx_production) are analyzed for known CVEs prior to push into private Harbor registry and GitOps deployment via Argo CD.
Secure Coding Standards & Code Review Traceability
Direct pushes to production branches are strictly forbidden (No one). All code changes require Merge Requests with passing automated linting (Ruff), test suites (Pytest), and security checks.
100% Renewable Hydropower Hosting
All DistantRace Kubernetes cluster nodes, compute servers, and storage buckets run in Hetzner Online EU data centers powered exclusively by 100% carbon-free renewable electricity generated from European hydropower.
Strict European Union Data Residency
All customer data, production PostgreSQL databases, athlete activity files, and system logs reside strictly within EU borders (Falkenstein, Nuremberg, and Helsinki data centers).
Network Isolation & Firewall Segmentation
Kubernetes cluster internal services (databases, Redis, in-cluster geocoder) are bound to private cluster networks with zero direct public internet exposure. Ingress is restricted via Nginx reverse proxies with TLS termination.
Encryption in Transit (TLS 1.3 & HSTS)
All communications between athlete apps, browsers, and DistantRace servers are strictly encrypted using TLS 1.3/TLS 1.2 with HTTP Strict Transport Security (HSTS) preloaded with max-age=518400.
Client-Side Encrypted Streaming Backups (age cryptography)
Database backups are generated using pg_dump streamed directly through modern 'age' public key cryptography before reaching storage. Zero unencrypted database dumps touch persistent disk.
Cookie Security & CSRF Hardening
Production session cookies enforce SESSION_COOKIE_SECURE=True, CSRF_COOKIE_SECURE=True, and SESSION_COOKIE_HTTPONLY=True to eliminate session hijacking and cross-site scripting exposure.
Centralized SSO & Enterprise IAM Access Enforcement
Administrative access to critical systems and internal platforms requires authentication through an enterprise Identity Provider with enforced Multi-Factor Authentication (TOTP / hardware security keys).
Strict 2-Tier Least Privilege Access Model
Production infrastructure, Kubernetes clusters, database secrets, and cloud consoles are restricted strictly to Tier 1 authorized systems engineering. Contractors operate strictly in Tier 2 with zero infrastructure access.
Workstation Security & Full-Disk Encryption
All administrative workstations enforce macOS FileVault full-disk encryption, automated screen lock timeouts (<=15 minutes), and hardware security key authentication.
Public Vulnerability Disclosure & Bug Intake Program
DistantRace maintains a published Responsible Disclosure Policy and dedicated public submission channel for ethical security researchers and bug reporters with clear safe harbor commitments.
Real-Time Error Tracking with Automated PII Scrubbing
Self-hosted Sentry continuously tracks runtime exceptions while scrubbing sensitive athlete PII, tokens, and credentials via scrub_route_sentry_event before ingestion.
System Heartbeat & Infrastructure Monitoring
Dedicated Zabbix monitoring probes monitor server resource limits, disk consumption, API heartbeats, and database connection pools with real-time alerting on anomalies.
Verified End-to-End Backup Restoration Drills
Backup recovery procedures are periodically tested through scripted end-to-end recovery drills (compose/db/restore_local.sh) validating schema integrity, record consistency, and recovery time objectives.
Object Storage Failover & Circuit Breakers
Object storage architecture supports automated failover circuit breaking between primary Hetzner storage and backup endpoints with health probe validation.
Statutory Background Verification & KYC
Key personnel undergo official background checks through the Latvian Ministry of the Interior (e.ic.iem.gov.lv), and contractors are vetted with statutory KYC and EU sanctions checks.
GDPR Article 17 Self-Service Right to be Forgotten
DistantRace provides a dedicated self-service data removal portal allowing athletes and account holders to request permanent deletion of their account, activity logs, and personal information with tracked ticket IDs.
Subprocessors & Integrations Registry
Comprehensive transparency into our core cloud providers, client-configured profile integrations, and wearable health APIs.
| Entity Name | Service & Role | Data Residency / Location | Data Processed | Legal Safeguards & Standards |
|---|---|---|---|---|
|
Hetzner Online GmbH
Core Cloud & Storage
Visit Website ↗
|
Cloud infrastructure, Kubernetes cluster nodes, bare-metal servers, and S3 object storage (nbg1) | Germany & Finland (EU) | Encrypted production databases, media storage, athlete activity records, encrypted backups | EU GDPR DPA, ISO/IEC 27001 certified data centers, powered by 100% renewable hydropower electricity |
|
SIA Creative IT development
DevOps & Managed Infrastructure
Visit Website ↗
|
Managed DevOps, CI/CD pipeline automation, application error monitoring, server health telemetry, and secondary SMTP mail delivery | Latvia (EU) | Application error logs, system telemetry, deployment pipelines, system notification delivery | Direct EU Data Processing Agreement (DPA), Master Services Agreement (MSA), statutory confidentiality obligations |
|
Authentik Identity Provider
Identity & Access Management
Visit Website ↗
|
Centralized single sign-on (SSO), OpenID Connect (OIDC), and Forward-Auth proxy identity provider | Germany (EU, Self-hosted) | Staff credentials, admin sessions, multi-factor authentication (TOTP/FIDO2) states | Self-hosted within private EU Kubernetes cluster perimeter; zero third-party telemetry |
|
TAC Security
Security Auditor & Assessment
Visit Website ↗
|
Authorized Cloud Application Security Assessment (CASA) Tier 1 auditor | United States / Global | Application vulnerability assessment evidence, CASA tier 1 verification reports | Standard Contractual Clauses (SCCs), marked 'In Compliance' on September 1, 2026 |
|
Socify
Compliance Automation
Visit Website ↗
|
SOC 2 Type II continuous compliance telemetry and evidence collection | European Union / United States | Infrastructure telemetry, configuration compliance logs, access control metadata | Standard Contractual Clauses (SCCs), continuous audit trail monitoring |
|
Cloudflare, Inc.
DNS & Edge Security
Visit Website ↗
|
Authoritative DNS resolution and edge security filtering | Global / European PoPs | DNS query logs, IP addresses for rate-limiting and DDoS mitigation | Cloudflare Data Processing Addendum & Standard Contractual Clauses |
|
Twilio Inc.
SMS & 2FA Gateway
Visit Website ↗
|
Platform two-factor authentication (2FA) SMS verification and critical system alerts | United States / Global | Phone numbers, one-time authentication passcodes, SMS transmission logs | Twilio Data Protection Addendum & Standard Contractual Clauses |
|
Amazon Web Services (Amazon SES)
Email Delivery Gateway
Visit Website ↗
|
Platform transactional email delivery and notifications | Ireland / Frankfurt (European Union) | Recipient email addresses, system notifications, delivery receipts | AWS GDPR Data Processing Addendum, EU data residency |
|
Stripe Payments Europe, Ltd.
Platform Payment Processing
Visit Website ↗
|
Direct DistantRace subscription and athlete entry fee processing | Ireland (European Union) | Payment card details, billing address, transaction tokens | PCI-DSS Level 1 Service Provider, Stripe EU Data Processing Agreement |
|
RevenueCat, Inc.
Mobile In-App Purchases
Visit Website ↗
|
Mobile subscription receipt validation and in-app purchase entitlement management | United States / Global | Anonymous app user IDs, app store purchase tokens, receipt validation metadata | RevenueCat Data Processing Agreement, SCCs |
|
Google LLC (Firebase Cloud Messaging)
Mobile Push Notifications
Visit Website ↗
|
Delivery of push notifications to DistantRace iOS and Android mobile apps | United States / Global | FCM device registration tokens, non-sensitive notification payloads | Google Cloud Data Processing Addendum |
|
Montonio Finance UAB
Client Payment Gateway (Optional)
Visit Website ↗
|
Event organizer payment processing (Baltic bank links, Apple Pay, cards) configured directly by clients in their profile | Lithuania (European Union) | Event ticket purchase transaction details (processed directly under organizer merchant account) | Licensed Payment Institution by Bank of Lithuania; client-controlled API keys |
|
EveryPay AS / AS SEB banka
Client Payment Gateway (Optional)
Visit Website ↗
|
SEB bank link and Baltic card payment gateway configured by clients in their profile | Estonia & Latvia (European Union) | Event ticket transaction references and settlement totals | Licensed EU Credit Institution & Payment Processor; client-controlled credentials |
|
Swedbank AS
Client Open Banking Gateway (Optional)
Visit Website ↗
|
Direct Swedbank open banking payment gateway configured by clients in their profile | Latvia (European Union) | Event entry fee transaction data and payment references | Licensed Credit Institution regulated by Bank of Latvia; client-controlled integration |
|
Omniva (AS Eesti Post / SIA Omniva)
Client Parcel Locker Shipping (Optional)
Visit Website ↗
|
Automated parcel locker shipping for race medals and participant packs, set up by organizers in their profile | Estonia & Latvia (European Union) | Athlete full name, phone number, and destination parcel locker terminal ID | National Postal Operator under EU GDPR regulations; organizer-controlled API contract |
|
Omnisend UAB
Client Email Automation (Optional)
Visit Website ↗
|
Organizer marketing newsletter automation, connected optionally by event organizers in their profile | Lithuania (European Union) | Consented participant emails for event announcements | EU GDPR DPA; client-provided API keys |
|
Text2Reach SIA
Client Event SMS Gateway (Optional)
Visit Website ↗
|
Direct participant race day announcements SMS gateway, configured by organizers in their profile | Latvia (European Union) | Participant phone numbers, organizer race alerts | Latvian Telecommunications Operator, statutory EU GDPR compliance |
|
Google LLC (Google Fit & Health Connect API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Synchronizes fitness activities, steps, active minutes, and distance recorded on Android devices | United States / EU Data Centers | Workout timestamps, step counts, calories, distance (synced only upon athlete OAuth consent) | Audited by TAC Security under Cloud Application Security Assessment (CASA) Tier 1; marked In Compliance September 1, 2026 |
|
Apple Inc. (Apple Health / HealthKit)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs workouts, active energy, and step history from Apple Watch and iOS HealthKit | United States / European Union | User-consented workout duration, distance, activity type, step count | Apple HealthKit Developer Agreement & user-controlled local device permissions |
|
Garmin Ltd. (Garmin Connect Developer API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs outdoor GPS routes, running, cycling, and multisport activities from Garmin wearables | United States / Switzerland / EU | GPS tracks, distance, elevation, pace, workout duration | Garmin Connect Developer Agreement & OAuth 2.0 athlete authorization |
|
Strava, Inc. (Strava API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Imports athlete-authorized public or private workout activities and GPS segments | United States | Activity title, start time, distance, duration, elevation | Strava API Agreement & OAuth 2.0 athlete consent |
|
Polar Electro Oy (Polar AccessLink API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs training sessions and daily activity totals from Polar sports watches | Kempele, Finland (European Union) | Activity summaries, training duration, distance, heart rate samples | EU-based Finnish entity, direct GDPR compliance & OAuth 2.0 authentication |
|
Suunto Oy (Suunto Cloud API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs outdoor adventure and training sessions recorded on Suunto watches | Vantaa, Finland (European Union) | Workout coordinates, duration, sport mode, elevation gain | EU-based Finnish manufacturer, strict European privacy standards & OAuth consent |
|
Fitbit LLC / Google (Fitbit Web API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Imports daily steps, activity distance, and tracked exercise logs | United States / European Union | Step logs, activity type, active duration | Google/Fitbit API Terms of Service & OAuth 2.0 authorization |
|
Wahoo Fitness (Wahoo Cloud API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs cycling and workout sessions from Wahoo ELEMNT and fitness sensors | United States | Cycling workout duration, power, cadence, distance | Wahoo Cloud Developer Agreement & user OAuth consent |
|
Whoop, Inc. (Whoop API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs athlete workout strain, recovery scores, and activity sessions | United States | Workout duration, strain score, average heart rate | Whoop Developer Platform Agreement & OAuth 2.0 consent |
|
Withings SA (Withings Health API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs daily step activity and wellness metrics from Withings smartwatches | Issy-les-Moulineaux, France (European Union) | Daily steps, active calories, workout sessions | French EU entity subject to GDPR & OAuth 2.0 protocol |
|
Decathlon SA (Decathlon Sports API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Syncs sports activities recorded via the Decathlon Coach platform | Villeneuve-d'Ascq, France (European Union) | Workout duration, sport category, distance | French EU entity, EU GDPR compliance & OAuth authentication |
|
Under Armour, Inc. (MapMyFitness API)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Imports running and fitness route logs from MapMyRun / MapMyFitness | United States | Route GPS, distance, speed, elapsed time | Under Armour Connected Fitness API terms & OAuth 2.0 tokenization |
|
Huawei Technologies Co., Ltd. (Huawei Health Kit)
Wearable & Activity Sync (User-Consented)
Visit Website ↗
|
Imports activity and workout summaries from Huawei Health wearables | China / European Union data processing | Steps, workout time, distance | Huawei Developer Terms & user account consent |
Compliance Resources & Documents
Request authorized access to security policies, compliance documentation, audit reports, and technical whitepapers.
TAC Security CASA AL1 Compliance Attestation
Formal Cloud Application Security Assessment (CASA) Tier 1 review letter issued by TAC Security, confirming DistantRace was marked 'In Compliance' on September 1, 2026.
SOC 2 Type II Audit Scope & Commitment Letter
Executive summary of DistantRace's SOC 2 Type II audit roadmap, Trust Services Criteria (Security & Availability), Socify continuous monitoring setup, and CPA observation window.
Information Security Policy & Framework Overview
Overview of DistantRace's information security management system, role-based access control, cryptographic standards, change control, and multi-factor authentication requirements.
Standard Data Processing Agreement (GDPR DPA)
Standard GDPR Data Processing Addendum pursuant to Article 28 GDPR for corporate clients, enterprise wellness programs, and event organizers processing athlete personal data.
GDPR Compliance & Architecture Whitepaper
Detailed explanation of DistantRace's European data residency (Hetzner Germany/Finland), data minimization principles, athlete privacy rights, and self-service Right to be Forgotten workflow.
Business Continuity & Disaster Recovery Plan Summary
Technical specification of daily automated client-side age-encrypted database backups, in-cluster MinIO storage failover, multi-site redundancy, and recovery point/time objectives (RPO/RTO).
TAC Security CASA AL1 Technical Evidence Summary
Confidential technical report detailing CASA AL1 evidence, Google Health Connect webhook validation, OAuth token security, and SAST scanner outputs.
Frequently Asked Questions
Direct answers to common security, compliance, data residency, and vendor assessment inquiries.
DistantRace underwent independent application security testing by TAC Security under Cloud Application Security Assessment (CASA) Tier 1 and was marked 'In Compliance' on September 1, 2026. We are currently actively preparing for our SOC 2 Type II examination with a certified CPA auditor via Socify. DistantRace does not hold other certifications at this time.
We are currently starting our SOC 2 Type II certification process. The controls framework has been mapped to our Kubernetes and Hetzner infrastructure using Socify for continuous compliance telemetry. The 3-month observation window is scheduled to conclude with our formal CPA audit report.
All DistantRace servers, Kubernetes worker nodes, PostgreSQL databases, and object storage buckets are hosted in the European Union within Hetzner Online GmbH data centers (primarily Falkenstein and Nuremberg, Germany, with secondary nodes in Helsinki, Finland). No customer data is hosted outside the European Union.
Hetzner Online data centers powering DistantRace use 100% carbon-free electricity generated exclusively from European hydropower stations certified under strict environmental standards. Our compute footprint does not rely on fossil-fuel power generation.
Core DevOps, CI/CD pipelines (GitLab), error tracking (Sentry), server health monitoring (Zabbix), and secondary SMTP relay (Postal) are operated and maintained by SIA Creative IT development, an EU-based technology partner in Riga, Latvia, under a formal Data Processing Agreement (DPA) and Master Services Agreement (MSA).
Yes. DistantRace is operated by Distant Race management SIA, a registered European Union company based in Riga, Latvia. We fully adhere to GDPR requirements, enforce strict data residency within the EU, execute Article 28 Data Processing Agreements (DPAs) with enterprise clients, and maintain a self-service Right to be Forgotten portal.
Users can exercise their GDPR Article 17 Right to Erasure directly via our self-service Data Removal Request form available on this Trust Center. Once submitted, a unique tracking ID (DR-RTBF-XXXX) is generated, and our privacy team processes the account and activity log deletion in accordance with statutory requirements.
Data in transit is encrypted using TLS 1.3 / TLS 1.2 with strict HTTP Strict Transport Security (HSTS) preloading. Production databases and persistent storage use AES-256 encryption at rest. Furthermore, daily automated database backup streams are encrypted client-side using modern 'age' public key cryptography before transmission to storage.
We perform automated daily client-side encrypted database backups with a Recovery Point Objective (RPO) of 24 hours and a Recovery Time Objective (RTO) of under 4 hours. Automated restoration drills are conducted regularly to verify backup integrity, database schema consistency, and end-to-end recovery scripts.
Yes. We operate a public Responsible Disclosure and Bug Submission program. Ethical security researchers and community members can submit vulnerability reports directly through our Trust Center Bug Submission form. We commit to acknowledging reports within 48 business hours and provide safe harbor protection for good-faith research.
Wearable fitness platforms are integrated solely on an opt-in basis via user-authorized OAuth 2.0. DistantRace requests only the minimum data required to calculate activity distances, steps, or challenge points. The Google Health integration has undergone independent CASA AL1 security assessment by TAC Security.
Core Subprocessors (such as Hetzner, Stripe, Twilio, and SIA Creative IT development) are essential infrastructure providers used by DistantRace to deliver the platform. Client-Configured Integrations (such as Montonio, EveryPay, Swedbank, Omniva parcel lockers, Omnisend, and Text2Reach) are configured directly by event organizers in their organization profile using their own merchant credentials or API keys.