{"componentChunkName":"component---src-templates-doc-jsx","path":"/docs/security-policy/","result":{"data":{"mdx":{"body":"function _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsxRuntime classic */\n\n/* @jsx mdx */\nconst _frontmatter = {\n  \"title\": \"Security Policy\"\n};\nconst layoutProps = {\n  _frontmatter\n};\nconst MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  let {\n    components\n  } = _ref,\n      props = _objectWithoutProperties(_ref, [\"components\"]);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"p\", null, `This document describes the security practices in place at Firstversionist B.V. (trading as Polypane). Given that Polypane is a single-person company, many controls that would otherwise be procedural are structural by design — there is only one person with access to sensitive systems.`), mdx(\"p\", null, `For vulnerability reporting, see our `, mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://polypane.app/.well-known/security.txt\"\n  }), `responsible disclosure policy`), `.`), mdx(\"hr\", null), mdx(\"h2\", {\n    \"id\": \"access-control\"\n  }, `Access Control`), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Access to servers and infrastructure is held exclusively by the founder (Kilian Valkhof). No other employees or contractors have standing access to production systems.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Access to customer account data is similarly limited to the founder.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Payment data is handled entirely by Paddle and is not accessible to Polypane.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Database infrastructure (Supabase) and backups are managed by those providers under their own access controls.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Access credentials are not shared.`)), mdx(\"h2\", {\n    \"id\": \"password-management\"\n  }, `Password Management`), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Strong, unique passwords are used for all services.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Passwords are managed using a password manager.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Two-factor authentication (2FA) is enabled on all accounts that support it, including email, payment processor, and hosting providers.`)), mdx(\"h2\", {\n    \"id\": \"patch-and-update-management\"\n  }, `Patch and Update Management`), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Server infrastructure is managed with automated tooling to ensure operating systems and packages are kept up to date on a formalized update schedule.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Polypane's browser engine (Chromium) is updated regularly, following Chromium's own release and security patch cycle.`)), mdx(\"h2\", {\n    \"id\": \"incident-response\"\n  }, `Incident Response`), mdx(\"p\", null, `Security incidents are handled on a case-by-case basis by the founder. In the event of a confirmed breach affecting customer data:`), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Affected customers will be notified via email as quickly as possible.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `We will assess the scope and take remediation steps appropriate to the incident.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `GDPR notification obligations will be met where applicable.`)), mdx(\"h2\", {\n    \"id\": \"vulnerability-reporting\"\n  }, `Vulnerability Reporting`), mdx(\"p\", null, `We have a responsible disclosure policy. If you discover a vulnerability in Polypane or our infrastructure, please report it via `, mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://polypane.app/.well-known/security.txt\"\n  }), `https://polypane.app/.well-known/security.txt`), `.`), mdx(\"h2\", {\n    \"id\": \"data-handling\"\n  }, `Data Handling`), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Customer PII is limited to name, email address, and account status.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Customer data is deleted upon request.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Backups are retained for up to 30 days, after which they are permanently deleted.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Email addresses are retained for up to six months after account deletion to prevent abuse.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `All data is transmitted over HTTPS with TLS 1.3.`)), mdx(\"h2\", {\n    \"id\": \"physical-security\"\n  }, `Physical Security`), mdx(\"p\", null, `Polypane is operated from a home office with controlled physical access. Physical security controls include:`), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Work devices use full-disk encryption and are password-protected with automatic screen lock.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Physical access to the premises is secured.`), mdx(\"li\", {\n    parentName: \"ul\"\n  }, `Offline backups are maintained in multiple separate physical locations.`)), mdx(\"h2\", {\n    \"id\": \"sub-processors\"\n  }, `Sub-processors`), mdx(\"p\", null, `All third-party providers that process customer data have Data Processing Agreements (DPAs) in place. See our `, mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"/privacy/\"\n  }), `Privacy Policy`), ` for the full list.`), mdx(\"hr\", null), mdx(\"p\", null, mdx(\"em\", {\n    parentName: \"p\"\n  }, `This policy is reviewed and updated as needed. Last updated: March 2026.`)));\n}\n;\nMDXContent.isMDXComponent = true;","timeToRead":2,"excerpt":"This document describes the security practices in place at Firstversionist B.V. (trading as Polypane). Given that Polypane is a single…","frontmatter":{"title":"Security Policy","cover":null,"date":null,"beta":null},"fields":{"nextTitle":"Making screenshots","nextSlug":"/docs/making-screenshots/","prevTitle":"Rulers, grids and guides","prevSlug":"/docs/rulers-grids-and-guides/","slug":"/docs/security-policy/","date":null,"ogFileName":"security-policy"}},"allMdx":{"edges":[{"node":{"fields":{"slug":"/docs/1-password-setup-instructions/"},"frontmatter":{"title":"1Password setup instructions"}}},{"node":{"fields":{"slug":"/docs/accessibility-audit-workflow/"},"frontmatter":{"title":"Accessibility audit workflow"}}},{"node":{"fields":{"slug":"/docs/accessibility-overview/"},"frontmatter":{"title":"Accessibility overview"}}},{"node":{"fields":{"slug":"/docs/accessibility-panel/"},"frontmatter":{"title":"Accessibility panel"}}},{"node":{"fields":{"slug":"/docs/application-folder/"},"frontmatter":{"title":"Application folder"}}},{"node":{"fields":{"slug":"/docs/brand-guidelines/"},"frontmatter":{"title":"Brand guidelines"}}},{"node":{"fields":{"slug":"/docs/breakpoints/"},"frontmatter":{"title":"Breakpoints"}}},{"node":{"fields":{"slug":"/docs/browse/"},"frontmatter":{"title":"Browse"}}},{"node":{"fields":{"slug":"/docs/browser-extensions/"},"frontmatter":{"title":"Browser extensions"}}},{"node":{"fields":{"slug":"/docs/browser-features/"},"frontmatter":{"title":"Browser features"}}},{"node":{"fields":{"slug":"/docs/browsersync-and-polypane/"},"frontmatter":{"title":"Browsersync and Polypane"}}},{"node":{"fields":{"slug":"/docs/color-picker/"},"frontmatter":{"title":"Color Picker"}}},{"node":{"fields":{"slug":"/docs/command-bar/"},"frontmatter":{"title":"Command Bar"}}},{"node":{"fields":{"slug":"/docs/command-line-options/"},"frontmatter":{"title":"Command line options"}}},{"node":{"fields":{"slug":"/docs/configuring-logitech-mouses/"},"frontmatter":{"title":"Configuring Logitech mouses"}}},{"node":{"fields":{"slug":"/docs/configuring-webstorm-to-work-with-polypane/"},"frontmatter":{"title":"Configuring WebStorm to work with Polypane"}}},{"node":{"fields":{"slug":"/docs/console/"},"frontmatter":{"title":"Console"}}},{"node":{"fields":{"slug":"/docs/customizing-polypane/"},"frontmatter":{"title":"Customizing Polypane"}}},{"node":{"fields":{"slug":"/docs/dark-and-light-mode/"},"frontmatter":{"title":"Dark and light mode"}}},{"node":{"fields":{"slug":"/docs/data-processing-agreement/"},"frontmatter":{"title":"Data Processing Agreement"}}},{"node":{"fields":{"slug":"/docs/debug-tools/"},"frontmatter":{"title":"Debug tools"}}},{"node":{"fields":{"slug":"/docs/detecting-polypane/"},"frontmatter":{"title":"Detecting Polypane"}}},{"node":{"fields":{"slug":"/docs/developer-tools/"},"frontmatter":{"title":"Developer tools"}}},{"node":{"fields":{"slug":"/docs/device-presets/"},"frontmatter":{"title":"Device presets"}}},{"node":{"fields":{"slug":"/docs/devtools-panel/"},"frontmatter":{"title":"Devtools Panel"}}},{"node":{"fields":{"slug":"/docs/elements-panel/"},"frontmatter":{"title":"Elements Panel"}}},{"node":{"fields":{"slug":"/docs/emulation/"},"frontmatter":{"title":"Emulation"}}},{"node":{"fields":{"slug":"/docs/experimental-chromium-features/"},"frontmatter":{"title":"Experimental Chromium features"}}},{"node":{"fields":{"slug":"/docs/find-elements/"},"frontmatter":{"title":"Find elements"}}},{"node":{"fields":{"slug":"/docs/form-autofill/"},"frontmatter":{"title":"Form autofill"}}},{"node":{"fields":{"slug":"/docs/global-zoom/"},"frontmatter":{"title":"Global zoom"}}},{"node":{"fields":{"slug":"/docs/helper-extension-for-other-browsers/"},"frontmatter":{"title":"Helper extension for other browsers"}}},{"node":{"fields":{"slug":"/docs/horizontal-overflow/"},"frontmatter":{"title":"Horizontal overflow detection"}}},{"node":{"fields":{"slug":"/docs/integrations/"},"frontmatter":{"title":"Integrations"}}},{"node":{"fields":{"slug":"/docs/intro-to-panel/"},"frontmatter":{"title":"Intro to panel"}}},{"node":{"fields":{"slug":"/docs/intro-to-panes/"},"frontmatter":{"title":"Intro to panes"}}},{"node":{"fields":{"slug":"/docs/json-and-xml-viewer/"},"frontmatter":{"title":"JSON and XML viewer"}}},{"node":{"fields":{"slug":"/docs/known-issues/"},"frontmatter":{"title":"Known issues"}}},{"node":{"fields":{"slug":"/docs/layout-debugging/"},"frontmatter":{"title":"Layout debugging"}}},{"node":{"fields":{"slug":"/docs/layouts/"},"frontmatter":{"title":"Layouts"}}},{"node":{"fields":{"slug":"/docs/link/"},"frontmatter":{"title":"Share panel"}}},{"node":{"fields":{"slug":"/docs/list-of-shortcuts/"},"frontmatter":{"title":"List of shortcuts"}}},{"node":{"fields":{"slug":"/docs/live-auto-reloading/"},"frontmatter":{"title":"Live/auto reloading"}}},{"node":{"fields":{"slug":"/docs/making-screenshots/"},"frontmatter":{"title":"Making screenshots"}}},{"node":{"fields":{"slug":"/docs/measure-text-length/"},"frontmatter":{"title":"Measure text length"}}},{"node":{"fields":{"slug":"/docs/mental-model/"},"frontmatter":{"title":"Mental model of Polypane's browser contexts"}}},{"node":{"fields":{"slug":"/docs/message-bus/"},"frontmatter":{"title":"Message Bus"}}},{"node":{"fields":{"slug":"/docs/meta-information/"},"frontmatter":{"title":"Meta information"}}},{"node":{"fields":{"slug":"/docs/network-panel/"},"frontmatter":{"title":"Network panel"}}},{"node":{"fields":{"slug":"/docs/other-tools/"},"frontmatter":{"title":"Polypane and local servers"}}},{"node":{"fields":{"slug":"/docs/outline-panel/"},"frontmatter":{"title":"Outline Panel"}}},{"node":{"fields":{"slug":"/docs/pane-management/"},"frontmatter":{"title":"Manage panes"}}},{"node":{"fields":{"slug":"/docs/pane-sizes/"},"frontmatter":{"title":"Pane sizes"}}},{"node":{"fields":{"slug":"/docs/performance/"},"frontmatter":{"title":"Performance"}}},{"node":{"fields":{"slug":"/docs/pitching-polypane/"},"frontmatter":{"title":"Pitching Polypane"}}},{"node":{"fields":{"slug":"/docs/polypane-peek/"},"frontmatter":{"title":"Polypane Peek"}}},{"node":{"fields":{"slug":"/docs/portal/"},"frontmatter":{"title":"Polypane Portal"}}},{"node":{"fields":{"slug":"/docs/projects/"},"frontmatter":{"title":"Projects"}}},{"node":{"fields":{"slug":"/docs/recording/"},"frontmatter":{"title":"Recording"}}},{"node":{"fields":{"slug":"/docs/reference-image/"},"frontmatter":{"title":"Reference image"}}},{"node":{"fields":{"slug":"/docs/reload-css/"},"frontmatter":{"title":"Reload CSS"}}},{"node":{"fields":{"slug":"/docs/responsive-debugging-workflow/"},"frontmatter":{"title":"Responsive debugging workflow"}}},{"node":{"fields":{"slug":"/docs/review-and-approval-by-it-and-security/"},"frontmatter":{"title":"Review and approval by IT and Security"}}},{"node":{"fields":{"slug":"/docs/rulers-grids-and-guides/"},"frontmatter":{"title":"Rulers, grids and guides"}}},{"node":{"fields":{"slug":"/docs/sales-and-procurement/"},"frontmatter":{"title":"Sales and Procurement"}}},{"node":{"fields":{"slug":"/docs/security-policy/"},"frontmatter":{"title":"Security Policy"}}},{"node":{"fields":{"slug":"/docs/security/"},"frontmatter":{"title":"Security"}}},{"node":{"fields":{"slug":"/docs/session-management/"},"frontmatter":{"title":"Session management"}}},{"node":{"fields":{"slug":"/docs/setup/"},"frontmatter":{"title":"Setup"}}},{"node":{"fields":{"slug":"/docs/showing-multiple-urls/"},"frontmatter":{"title":"Showing multiple URLs"}}},{"node":{"fields":{"slug":"/docs/simulators/"},"frontmatter":{"title":"Simulators"}}},{"node":{"fields":{"slug":"/docs/snippets/"},"frontmatter":{"title":"Snippets"}}},{"node":{"fields":{"slug":"/docs/social-card-and-open-graph-workflow/"},"frontmatter":{"title":"Social card and Open Graph workflow"}}},{"node":{"fields":{"slug":"/docs/source-panel/"},"frontmatter":{"title":"Source panel"}}},{"node":{"fields":{"slug":"/docs/storage-panel/"},"frontmatter":{"title":"Storage panel"}}},{"node":{"fields":{"slug":"/docs/switching-to-polypane/"},"frontmatter":{"title":"Switching to Polypane"}}},{"node":{"fields":{"slug":"/docs/synced-interactions/"},"frontmatter":{"title":"Synced interactions"}}},{"node":{"fields":{"slug":"/docs/tab-customization/"},"frontmatter":{"title":"Tab customization"}}},{"node":{"fields":{"slug":"/docs/team-workflows/"},"frontmatter":{"title":"Team workflows"}}},{"node":{"fields":{"slug":"/docs/ui-overview/"},"frontmatter":{"title":"Polypane UI overview"}}},{"node":{"fields":{"slug":"/docs/web-vitals/"},"frontmatter":{"title":"Web Vitals"}}},{"node":{"fields":{"slug":"/docs/website-issues-you-could-encounter/"},"frontmatter":{"title":"Website issues you could encounter"}}},{"node":{"fields":{"slug":"/docs/workspace-management/"},"frontmatter":{"title":"Workspace management"}}},{"node":{"fields":{"slug":"/docs/workspaces/"},"frontmatter":{"title":"Workspaces"}}}]}},"pageContext":{"slug":"/docs/security-policy/"}},"staticQueryHashes":["4164364741","425175329"]}