Trust and data handling
WarnFire is operated by Simon Says Technology LLC, doing business as WarnFire. This page explains the service's data-handling posture alongside the Privacy Policy, Terms and security practices.
Where the core service runs
The production application and managed PostgreSQL database run in DigitalOcean's SFO3 region in the United States. Other service providers process information as needed to deliver the features below. This is not a promise that all processing remains in one country or region. If you require a specific residency commitment, contact us before submitting data or purchasing the service.
Service providers and their purposes
The providers involved depend on the features you enable. Communications and push delivery may involve infrastructure and carriers in the recipient's country. Customer-connected collaboration tools also process the incident information you choose to share with them.
| Provider | Purpose and data involved | Location information |
|---|---|---|
| DigitalOcean | Application hosting and managed PostgreSQL; workspace, configuration and incident records. | Core production application and database: SFO3, United States. |
| Amazon Web Services | Transactional and notification email; backup storage; status-page hosting and delivery. | Service and delivery locations vary; public and private status-page delivery can use global edge infrastructure. |
| Backblaze | Off-site encrypted backup storage. | Backup repository location is an operational setting; no exclusive-region commitment is made by this page. |
| Temporal Technologies | Durable execution of incident escalation and notification workflows. | Managed-service processing; contact us for a residency review before purchase. |
| Apple and Google Firebase | Push delivery to configured iOS and Android installations. | Provider-operated delivery infrastructure; device and recipient location vary. |
| Telnyx and Twilio | Configured SMS and voice paging; recipient destinations, notification content and delivery metadata. | Provider and carrier routing, including the recipient's country. |
| Stripe | Subscriptions, payments and billing records. | Provider-managed payment processing; payment-method data is handled by Stripe. |
| Sentry | Sanitized crash and error diagnostics; application version, operation category and correlation metadata. | United States ingestion endpoints. Incident content, credentials and request bodies are excluded by WarnFire's diagnostic configuration. |
| Google Analytics | Optional public-website measurement after consent; page and interaction data. It is not installed in the customer console. | Google-operated processing; see the Privacy Policy and analytics preferences. |
| Zoom and Slack | Customer-connected incident meetings, channels and updates when enabled. | Processing follows the connected account and provider's service terms and settings. |
Retention and deletion
These categories have different purposes. A diagnostic cleanup window is not a promise to erase an incident's history, and deletion from the running service does not immediately erase retained backups.
| Category | Current handling |
|---|---|
| Account and workspace configuration | Retained while needed to operate the workspace. Verified deletion removes or de-identifies associated operational data, subject to necessary billing, legal and security retention. |
| Incident, delivery and audit history | Retained as the workspace's operational record; no general fixed-age purge is promised. Deleting a person's account can preserve incident participation, delivery evidence and audit attribution while removing access and contact methods. |
| Completed heartbeat runs and delivered state transitions | Eligible for bounded cleanup after 90 days. Actively monitored runs and undelivered transitions are protected. |
| Heartbeat ping receipts | Eligible for bounded cleanup after 7 days. |
| Opt-in integration payload captures | Eligible for cleanup after 7 days. |
| Billing and security records | Retained when necessary for billing, disputes, fraud prevention, security or applicable law. |
| Encrypted backups | Expire through backup rotation and applicable immutable-object retention. Backup erasure is not immediate; no fixed deletion deadline is offered by this page. |
Cleanup runs in bounded batches, so eligibility is not an exact deletion timestamp. To request access, correction or verified deletion, use Privacy choices or contact support@warnfire.com.
Security and compliance posture
WarnFire uses role-based authorization, tenant isolation, restricted service networking, protected credentials and accountable operational history. See the current security practices for the scope of those safeguards.
WarnFire does not claim SOC 2 certification or offer a SOC 2 report through this page. WarnFire makes no HIPAA compliance claim and does not offer a business associate agreement. Do not submit protected health information where a BAA is required.
Report a vulnerability or suspected incident
Email support@warnfire.com with the affected feature, a concise description, reproduction steps and impact. Do not send active credentials or another customer's data. We assess reports and handle notification under applicable law and contractual obligations. This page does not establish a fixed support-response or breach-notification deadline.