Security and trust
A robot cell backup describes a production installation: programs, inputs and outputs, frames, safety parameters. Here is how those files are protected, and what we forbid ourselves from doing with them.
Last revised:
Isolation between organizations
Every business record carries the organization it belongs to, and no query can leave it. Isolation is enforced at two independent levels: in the application, and in the database itself through PostgreSQL row-level security policies.
Two levels rather than one, because a single level is enough only while the code is perfect. The second is the one that holds when the first has a defect: even a badly written query cannot return another organization's row, because the database refuses to hand it over.
The application role that serves traffic is neither a superuser nor an owner of the tables — three situations in PostgreSQL allow those policies to be bypassed, and the service refuses to start if it detects any of them.
Encryption
In transit: TLS on every access to the service — web interface, API calls, object storage.
At rest: object storage and the database are encrypted by the platforms that host them. Archives are never in a public space: they are reachable through a short-lived signed link, cryptographically bound to ONE specific object, and issued only after checking that the requester belongs to the owning organization. The link carries the object; our own route carries the organization.
What the product does not do
Maatron reads files. It connects to no controller, writes to no robot, deploys no program and triggers no motion. This limit is not a missing feature: it is what guarantees that a mistake on our side cannot reach a production cell.
Your files are not used to train any model. They remain yours, and the automated processing that analyzes them is deterministic — same files, same result — rather than probabilistic.
No customer data in development
No customer archive enters development, test or demonstration environments — not even to reproduce an incident or prepare a demonstration. Test material is built for the purpose, or derived from neutralized controller output: identifiers genericised, tied to no real installation.
Those are precisely the contexts where vigilance slips, so the rule there is identical rather than relaxed.
Retention and deletion
Three deadlines, because a single figure would be wrong in both directions: loss of access is immediate, while no serious backup system rewrites itself on demand.
Access revocation: immediate, on request. The data stops being reachable by anyone.
Erasure from live systems (object storage and database): thirty days at most.
Destruction of backup and disaster-recovery copies: sixty days at most, as their own cycle expires.
The detail is set out in Privacy policy and in Data Processing Agreement.
Reporting a vulnerability
Write to info@maatron.dev. We acknowledge receipt and keep you informed of the handling. No action will be taken against good-faith research that does not degrade the service and does not touch other people's data.