Security
Technical and organisational measures for Topolo services.
Infrastructure
Topolo services are built primarily on Cloudflare infrastructure, including Workers, D1, KV and R2 where applicable. Managed infrastructure protections are supplemented by the application and access controls relevant to each service. External providers are identified in our subprocessor list.
Access and data protection
Measures include HTTPS connections; account, organisation and application permissions; scoped supported API and agent credentials; restricted operational access; confidentiality obligations; and production/test environment separation. Customers manage their authorised users, agents, access grants and supported security settings.
Operational security
Topolo uses operational and security logging, credential-handling controls, incident investigation and response, and processes to assess and address vulnerabilities. Measures are maintained according to the nature of the processing and its risks. Annex II of the Data Processing Agreement describes the contractual technical and organisational measures. The DPA also addresses incident notification, assistance and applicable audit rights.
Contact and responsible disclosure
Contact security@topolo.io for security questions or vulnerability reports. Do not include credentials or unnecessary personal data. Intrusive security testing requires prior written authorisation and an agreed scope to protect the service and other users.