# Security and reliability

How MapIron protects your account, your keys and the data you send, where it runs, and what we do and don't hold certificates for.

## Certifications

MapIron is not SOC 2 or ISO 27001 certified. If your review needs a questionnaire answered, send it to [sales@mapiron.com](mailto:sales@mapiron.com).

## Accounts and keys

- API keys are stored only as SHA-256 hashes and are shown once, when you create them.
- Keys can be locked to your domains and revoked at any time. On platform contracts each key can also have its own cap and be rotated with an overlap of up to 24 hours.
- Two-step sign-in with passkeys or an authenticator app, plus recovery codes. Once an account has a second step, an emailed code alone never signs it in.
- Creating keys, changing billing and changing security settings need a fresh sign-in or confirmation.
- Every security change and every new key is emailed to the account owner.
- Sign-in codes are rate-limited per address and per network, and compared in constant time.

## Privacy area mode

A privacy-area image never contains the exact point. The point is snapped to a grid of at least 0.005° (about 550 m) before anything is drawn, so every address in the same grid cell gets the identical image.

## Network and hosting

- All traffic uses TLS 1.2 or later, with HSTS. The database connection is encrypted and verifies the server's certificate.
- The servers accept no inbound web traffic: requests reach them only through a Cloudflare Tunnel, and SSH is limited to one administration address.
- The API and its database run in DigitalOcean's New York region in the United States. Map tiles are cached at Cloudflare's edge.
- A weekly external scan checks open ports, certificates, security headers and DNS for changes.

## Backups and recovery

- The managed database has daily backups with point-in-time recovery, and a separate daily copy is kept off DigitalOcean.
- A backup is restored and checked every week.
- A monthly disaster-recovery drill rebuilds the API from backups on separate hardware and records how long it took.

## Uptime

Live status and 90-day history are on the [status page](https://mapiron.com/status). The Business plan has a 99.5% monthly uptime target with service credits: 10% below 99.5% and 50% below 99%. Enterprise contracts can commit to more.

## Service providers

| Provider | What it does for MapIron | Where |
| --- | --- | --- |
| DigitalOcean | Servers and the managed database | United States (New York) |
| Cloudflare | Network edge, tile cache, DNS, inbound email | Global |
| Stripe | Payments and invoices | United States |
| Resend | Account and billing email | United States |
| Google Analytics | Website statistics on public pages, only if you allow it ([privacy choices](https://mapiron.com/privacy-choices)) | United States |

Map data © OpenStreetMap contributors. More detail in the [privacy policy](https://mapiron.com/privacy).

## Report a vulnerability

Email [security@mapiron.com](mailto:security@mapiron.com) with the details and how to reproduce it. Please don't access other people's data or degrade the service while testing.

[Talk to sales](https://mapiron.com/enterprise#contact)

---
Source: https://mapiron.com/security · Map data © OpenStreetMap contributors · Index: https://mapiron.com/llms.txt