Privacy Policy
Effective Date: November 6, 2026 · Document Version 2.1 · Cloudflare Global Edge Network
Zero-Knowledge Secret Vault
API tokens and authentication keys are stored using hardware-accelerated AES-256-GCM authenticated encryption. We never store, log, or inspect plaintext secrets.
Transient Edge Processing
Upstream API payloads are executed and reshaped in volatile edge memory. We do not permanently store or analyze your upstream JSON payload contents in a persistent database.
Zero Data Brokerage
RealComposer is a developer infrastructure utility. We do not sell, rent, monetize, or feed your account metadata, pipeline schemas, or traffic to AI training models or advertisers.
1. Scope & Architecture Overview
RealComposer (“we,” “our,” or “us”) provides high-performance edge API orchestration, webhook transformation, secret injection, and payload optimization services deployed across global edge runtimes.
This Privacy Policy describes our practices regarding the collection, processing, protection, and disclosure of information when developers, organizations, and end users interact with our website (realcomposer.com), the RealComposer Control Plane dashboard, and edge endpoints deployed under our proxy gateway.
By creating a RealComposer account or routing API requests through our edge pipelines, you acknowledge the data handling practices described herein.
2. Information We Collect
We minimize data collection strictly to what is necessary to operate, secure, and deliver high-performance edge API aggregation:
Account & Identity Credentials
When you authenticate, we collect your email address for passwordless magic link delivery, or your public GitHub identifier and handle if signing in via GitHub OAuth. RealComposer operates on a zero-password model; we never ask for, process, or store passwords.
Pipeline Configuration Schemas
We persist your pipeline configurations, including public route paths, upstream HTTP endpoints, JSON query path filters, field mappings, cache TTL specifications, and fallback definitions.
Encrypted Vault Secrets
When you define secret tokens (such as third-party API keys, bearer tokens, or webhook signatures), these values are encrypted client-side or during vault submission using AES-256-GCM. We store only ciphertext, nonce/IV parameters, and authentication tags. Plaintext values are never stored.
3. Secret Vault & Cryptographic Architecture
Security of developer credentials is foundational to RealComposer. Upstream secrets are secured through an explicit zero-knowledge design:
- AES-256-GCM Encryption: Secrets are encrypted with 256-bit keys using Galois/Counter Mode authenticated encryption, providing both confidentiality and cryptographic integrity verification.
- Runtime-Only Decryption: Decryption occurs exclusively in isolated Cloudflare Workers execution contexts during live pipeline proxy execution, injecting headers directly into upstream network calls.
- Sanitization & Zero Plaintext Logging: Diagnostic systems automatically scrub and mask secret tokens. Telemetry events record only secret metadata keys (e.g. STRIPE_SECRET), never decrypted values.
4. Transient Edge Payloads & Caching Lifecycle
When a client application invokes a pipeline endpoint (/v1/{workspace}/{slug}), the request is processed transiently at the nearest edge point of presence:
Edge Caching Rules: If edge caching is enabled on a pipeline, the transformed output payload is cached in Cloudflare Cache API or edge KV according to your configured TTL (e.g., 60 seconds) indexed by a cryptographic hash of the incoming request parameters. Cache entries expire automatically and can be purged on demand.
5. Telemetry, Logs & Diagnostics
To provide observability in your Control Plane dashboard, our edge runtime collects operational metadata:
- • Request timestamp & HTTP method
- • Pipeline slug & Workspace ID
- • Upstream HTTP status codes
- • Total edge duration (milliseconds)
- • Cache HIT / MISS status
- • Raw vs. slimmed byte counts
- × Decrypted API vault secrets
- × Upstream authorization headers
- × Full JSON request body payloads
- × Full upstream response payloads
- × User browser session passwords
- × End-user PII payload values
Operational telemetry logs are retained for a rolling maximum of 30 days for active accounts and are permanently purged thereafter.
6. Third-Party Subprocessors
RealComposer partners with trusted cloud infrastructure providers to deliver global reliability, scale, and high-assurance security:
7. Data Retention & Account Deletion
You retain complete control over your data stored within RealComposer:
- Immediate Secret Removal: When you delete an API secret from the Secret Vault, its ciphertext and associated encryption records are permanently deleted from database records immediately.
- Pipeline Schema Purge: Deleting a pipeline instantly disables its edge execution route and permanently deletes its transformation configuration.
- Account Closure: Upon receiving an account closure request, all workspace records, pipelines, credentials, and telemetry entries are irreversibly expunged within 48 hours.
8. Developer Rights (GDPR & CCPA Compliance)
Depending on your location, you may have statutory rights under the General Data Protection Regulation (GDPR), the UK Data Protection Act, or the California Consumer Privacy Act (CCPA/CPRA):
Request an exported copy of your account profile, workspace definitions, and pipeline configurations in standard JSON format.
Demand complete deletion of all personal identifiers, workspaces, and associated operational logs without unreasonable delay.
Modify or correct your registered contact email and workspace profile settings at any time in the dashboard.
We will never discriminate, degrade service latency, or restrict developer features because you exercised your privacy rights.
9. Security Measures & Operational Controls
We maintain administrative, technical, and physical safeguards designed to protect developer data against unauthorized access, loss, or alteration:
- Strict TLS 1.3 encryption across all public ingress and upstream egress network traffic.
- Zero-trust network architecture with tenant-isolated database row-level boundaries.
- Automated vulnerability scans and continuous cryptographic integrity checks.
10. Updates & Contact Information
We may revise this Privacy Policy periodically to reflect technological advancements, architectural changes, or legal updates. When changes occur, we will update the “Last Updated” timestamp and provide prominent notification on our website or via email.
SECURITY & PRIVACY OFFICE
For privacy requests, GDPR inquiries, or data subject rights, submit an inquiry through our bot-protected gateway: