Security Overview

Last Updated: 7 May 2026

This page provides an overview of the security measures and practices that protect Subnet Calc and your data. The Service is developed and maintained by Inflecto Systems Ltd on behalf of Subnet Calc Limited.

Authentication

  • No passwords stored — Subnet Calc uses OAuth-only authentication via Microsoft, Google, and Apple. We never see, store, or process your password.
  • Identity linking — if you sign in with multiple providers using the same email address, they are linked to a single Account.
  • Session tokens — upon authentication, a short-lived JWT (15-minute expiry) is issued within an HttpOnly, Secure, SameSite cookie. A server-side refresh token (24-hour or 90-day expiry) enables seamless re-authentication.
  • Server-side session validation — every request validates the session against server-side state. Expired or revoked sessions are rejected immediately.

Encryption

In Transit

All connections to Subnet Calc are encrypted using TLS 1.2+. This includes:

  • Browser to frontend
  • Frontend to backend APIs
  • Backend to data storage
  • Backend to third-party services (Stripe, SendGrid)

At Rest

All stored data is encrypted using AES-256 encryption.

Infrastructure

Cloud Platform

Subnet Calc runs entirely on Microsoft Azure, using serverless compute, encrypted data storage, and global load balancing with web application firewall (WAF) protection.

Multi-Region Architecture

The Service is deployed across three geographic regions for redundancy and low-latency access:

  • North Europe (Ireland) — primary
  • East US (Virginia)
  • Australia East (New South Wales)

Global data (accounts, team membership) is replicated across all regions. Regional data (full project designs) is stored in the assigned region only. See our Data Residency Statement for details.

Web Application Firewall (WAF)

Our global load balancer provides WAF protection against common web vulnerabilities including those in the OWASP Top 10.

Payment Security

Subnet Calc does not process, store, or transmit payment card data.

  • All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor.
  • Customers complete payments via Stripe Checkout (a Stripe-hosted page). Payment details never touch Subnet Calc servers.
  • We store only Stripe Customer and Subscription identifiers to manage account billing status.

Access Controls

  • Role-based access — team members are assigned roles (owner, admin, member) with corresponding permissions.
  • Design locks — concurrent editing protection ensures only one user can modify a subnet design at a time.
  • Principle of least privilege — infrastructure access is limited to authorised personnel at Inflecto Systems Ltd who require it for development, maintenance, and support.

Operational Security

  • No shared credentials — all infrastructure access uses individual identities.
  • Dependency scanning — automated vulnerability scanning of third-party dependencies.
  • Secure development practices — code review, automated testing, and security checks are part of the development lifecycle.
  • Incident response — documented incident response and disaster recovery procedures, including multi-region failover capabilities.

Cookie Security

  • The session cookie is configured with HttpOnly (no JavaScript access), Secure (HTTPS only), and SameSite=Lax attributes.
  • Cookie lifetime is aligned with server-side session lifetime — the cookie cannot outlive the server session.
  • No advertising or third-party tracking cookies are used.

See our Cookie Policy for full details.

Responsible Disclosure

We welcome reports of security vulnerabilities from researchers and the community. See our Responsible Disclosure Policy for how to report issues.

Questions

For security-related enquiries, submit a request via our support page.