Trust and security

Where your data lives

• Merging happens in your browser. Your spreadsheet rows are not uploaded unless you choose to save a result.
• The MasterMerge service and its database run on servers rented from Hetzner Online in Finland, in the European Union.
• Files you choose to save, such as merged results and imports, are stored in object storage (Cloudflare R2), or in your own bucket if you choose (below).
• Payments go through Stripe. MasterMerge never sees or stores card numbers.

Every workspace kept apart

• Every record carries its workspace, and every request is checked against the signed-in person's workspace before any data is read.
• The database enforces the same separation itself (PostgreSQL row-level security), so a mistake in one page of code still cannot show one workspace another workspace's rows.
• Roles inside a workspace (owner, admin, editor, viewer) decide who can change settings, billing, people and data.

Sign-in, keys and secrets

• Passwords are stored only as salted hashes. Sign-in attempts are rate limited.
• Each app gets its own token, which an admin can revoke at any time. Tokens are stored only as hashes.
• Webhook secrets and license keys are encrypted at rest. They are never written to logs or sent back by the API.
• All traffic is encrypted in transit (HTTPS).

Backups and records

• The database is backed up every night: seven daily, four weekly and twelve monthly copies are kept, then the oldest are removed.
• Plan changes, billing, licensing and staff support access are recorded in an audit log.
• When MasterMerge staff open a workspace to help, the visit is time-limited, needs a reason and is logged.

Owning your data

• Premium workspaces can keep their files in their own Cloudflare R2 or S3-compatible bucket, so they never sit in MasterMerge's storage.
• Teams that need it can have MasterMerge on a dedicated server of their own. Talk to us.