Security at Sim2Real
This page describes how Sim2Real is hosted, how customer data is protected, and what our current certification status is. We state plainly what is in place today and what is not — if something below matters to your evaluation, raise it during pilot scoping.
Last updated: July 25, 2026
Hosting & infrastructure
Sim2Real is a cloud-hosted service running on Railway, a managed cloud platform. Data is processed in the United States by default, consistent with our Privacy Policy. VPC, on-premise, regional, and air-gapped deployments are not standard offerings; they are evaluated individually for qualified enterprise engagements, and evaluation does not guarantee availability.
Encryption
All traffic to and from Sim2Real is encrypted in transit with TLS, and HTTP Strict Transport Security (HSTS) is enforced. Data at rest is stored on our cloud provider's managed storage; Sim2Real does not currently apply additional application-layer encryption at rest. Passwords and API keys are never stored in plaintext (see below).
Workspace isolation
Every deployment record, failure cluster, telemetry event, and API key is scoped to a single authenticated workspace. All workspace reads and writes are filtered server-side by the authenticated account — one customer's data is never returned in another customer's queries.
Authentication & sessions
Sign-in options are email and password, or OAuth via Google and Apple. Passwords are hashed with Argon2id (legacy PBKDF2-SHA256 hashes are upgraded to Argon2id on the next successful login). Sessions are server-side with a 12-hour lifetime, and every session is revoked when a password is reset or changed. Authentication endpoints are rate-limited, and state-changing requests are CSRF-protected.
API-key handling
Telemetry API keys are generated as 256-bit random values. The full key is shown once at creation; for keys issued by the current system only a SHA-256 hash and a short display prefix are retained. Keys can be revoked at any time from the account workspace, and revoked keys are rejected immediately.
Application security controls
The application sends standard browser hardening headers on every response, including a Content Security Policy, X-Frame-Options: DENY with frame-ancestors 'none', X-Content-Type-Options: nosniff, a strict referrer policy, and a restrictive Permissions-Policy. Auth, contact, and webhook endpoints are independently rate-limited.
Payments
Payments are processed by Stripe on Stripe-hosted pages. Card numbers are entered directly with Stripe and never touch Sim2Real servers. Stripe webhook messages are signature-verified before they are trusted.
Retention & deletion
Retention expectations for pilot telemetry are scoped at intake as part of the pilot agreement. Account and telemetry deletion is available on request: email [email protected] from the account's email address and we will confirm the deletion scope and timeline with you. See the Privacy Policy for the categories of data we hold.
Your data stays yours
Ownership
Telemetry, deployment records, and any other data you submit to Sim2Real remain yours. We process it to provide the service described in our Terms of Service, and you can request export or deletion at any time.
No shared-model training
Customer data is not used to train shared models. Analysis of your telemetry happens within your workspace, for your workspace. We do not pool customer telemetry into cross-customer training sets, and we will not do so without explicit written agreement.
What we are — and are not — certified for
We would rather tell you exactly where we stand than imply a certification we do not hold.
Current status
Sim2Real has not completed a SOC 2 audit, ISO 27001 certification, or any other third-party security certification, and we do not claim HIPAA, FedRAMP, or PCI DSS compliance beyond what is inherited by using Stripe for payment processing. If your procurement process requires specific attestations, tell us during scoping and we will state plainly whether we can meet them.
Security questionnaires
For pilot and enterprise evaluations we will answer security questionnaires honestly, including the items above where the answer is currently "no". Contact [email protected] to start that conversation.
Vulnerability reporting & incident contact
Report a vulnerability
If you believe you have found a security vulnerability in Sim2Real, email [email protected] with "Vulnerability report" in the subject line. Include steps to reproduce and the affected URL or endpoint. We appreciate good-faith research; please do not access data belonging to other customers, and do not run disruptive automated testing against the production service. We do not currently operate a paid bug-bounty program.
Security incidents
Customers who suspect a security incident affecting their account or data should contact [email protected]. We will acknowledge the report, investigate, and communicate findings and any required notifications consistent with our legal obligations.