Knowledge Base
Data and security overview
Where your data lives, which providers handle it, and the protections in place.
Updated 21 September 2026.
Where your data lives
Crossleaf runs on Railway in the United States, with a managed Postgres database. Backups are kept by the host for a limited period.
Providers that handle your data
| Provider | What it does | What it sees |
|---|---|---|
| OpenRouter and the model you choose | Translation and polishing | The text of the job; not used for training |
| Railway | Hosting and database | Everything the service stores |
| Stripe | Payments | Your card and billing details; we never see the card. From us, your email address, the name on your account and our internal account id |
| Resend | Our emails: sign-up confirmation, password reset, confirming a new address, the address-changed and password-changed notices, messages sent through the support form, and the notices about an account's payments that we send to ourselves | Your email address and those messages; with a support message, your reply address, the page you wrote from and, if you are signed in, your account email, leaf balance, plan and internal account id; with a payment notice, the email address of the account it is about |
| Google Fonts | Typefaces | Your IP address when a page loads |
Protections
- Passwords are hashed with bcrypt; they are never stored or logged in clear text.
- Session tokens are random 256-bit values stored hashed; changing your password revokes every other session.
- All traffic is encrypted with HTTPS; a strict Content Security Policy blocks scripts from anywhere but crossleaf.app.
- Uploads are read only after sign-in, with size caps, decompression limits, and per-account quotas.
- Administrative actions are logged with the acting administrator.
- Sign-up and sign-in records are kept for 90 days and anonymized when an account is deleted.
- The service runs as an unprivileged user in an isolated container, and the database enforces ownership links between accounts and their content.
Reporting a security issue
Write to hello@crossleaf.app. Please give us a reasonable time to fix a problem before publishing it; we will credit reporters who ask.