Security

• Company: Malm Wealth Oy, a Finnish limited liability company (osakeyhtiö)
• Business ID: 3647580-9
• VAT number: FI36475809
• Registered in the Finnish Trade Register, kept by the Finnish Patent and Registration Office
• Domicile: Espoo, Finland
• Email: hello@malmhq.com

• The site is hosted on Cloudflare and served only over HTTPS. Requests over plain HTTP are redirected to HTTPS. TLS is provided by Cloudflare.
• Evaluation data is kept in Cloudflare R2. Cloudflare encrypts data stored in R2 at rest.
• Evaluation data is stored in Cloudflare's Western Europe region.
• Evaluation request emails are kept in Clerk and stored in the EU.

• Multi-factor authentication is required on all critical accounts: source control, hosting, authentication, analytics, domain and email.
• Production access is limited to named team members. We remove it when someone leaves.
• Work devices use full-disk encryption and automatic screen lock.

• Changes reach production only through reviewed pull requests with automated checks.
• Dependencies are scanned automatically.
• Secrets are kept in a secrets manager, not in the code repository.

• The site has no user accounts, so we hold no passwords.
• The site takes no payments, so we hold no payment data.
• The only personal detail you can send us through the site is an email address, to request an evaluation.

If a personal data breach happens, the GDPR requires us to notify the Office of the Data Protection Ombudsman and, where the law requires it, the people affected. We will do so.

• Email your report to hello@malmhq.com.
• We acknowledge reports.
• Please give us reasonable time to fix an issue before you disclose it.
• We do not offer a bounty.

Security and privacy questions: hello@malmhq.com.

• Terms of service
• Privacy policy
• Cookie settings: use the Cookie settings link in the footer of any page.