Trust: Security, Backups and Operations

Before you put a production site on Neleto, you should be able to check how it is run. This page collects the facts: where data is stored, what happens when something breaks, who can access what, and how you get your content out again.

At a glance

Where your data lives

Neleto runs on servers operated by Hetzner Online GmbH. When you create a site, you choose its region, on every plan:

Your content, files, database and backups stay in the region you choose. If you choose the USA or Asia, your site's data is stored outside the EU. Hetzner Online GmbH, a German company, remains the operator. Check whether that fits your own data protection requirements before you choose one of these regions.

On Enterprise, your site gets a server of its own. Sites on Free, Solo and Business share servers; each site runs in its own containers with its own database.

All traffic to Neleto sites and the admin is encrypted with TLS, using Let's Encrypt certificates.

Neleto is the data processor for personal data in your site; you are the controller. We provide a data processing agreement under Art. 28 GDPR on request.

Sub-processor for your site's data (annex 1 of the data processing agreement):

Services we use for our own operations. For these we are the controller, and they don't process the content of your site:

Backups and restore

Backups use Hetzner's server backup: a complete copy of the server your site runs on, made automatically once a day. The last seven are kept.

• What's included: your site's database, uploaded files, settings and translations, all from the same moment.
• Where backups are stored: at Hetzner, at the same location as your server. They never leave the region you chose.
• Deleted data: whatever you delete on your site is gone from the backups too after seven days at the latest, because the oldest copy is replaced every day.
• How to restore: write to support. We restore your site to the day you choose, within one business day. Anything changed on your site after that backup is lost, so we agree the date with you first.

Separate from backups, every site has a Restore page in the admin (/admin/restore). Deleted pages, layouts, components, elements, files, users, translations and redirects land there first and stay until someone deletes them for good. So a wrong click, by a person or an AI agent, can be undone without a backup.

Availability

We aim for 99.5% availability per month, excluding maintenance we announce in advance. A guaranteed level with credits is available only when agreed in writing, typically on Enterprise.

Every site reports to our console continuously, and its homepage is checked every five minutes.

Support response times

Business days are Monday to Friday, 9:00 to 17:00 CET.

Accounts and access

• Roles: four built-in roles: Admin, Developer, Editor and Author. Admin can do everything. Developer can do everything except manage roles, including layouts, components, plugins and settings. Editor manages pages, posts, events, files, redirects and translations, and can view layouts and components.
• Custom roles: you can create your own roles and switch individual permissions on or off.
• Passwords: stored as salted PBKDF2-HMAC-SHA512 hashes with 100,000 iterations. Never in plain text.
• Login protection: after 10 failed attempts on one account, or 50 from one IP address, within 15 minutes, further attempts are blocked.
• Activity log: creating, changing, moving and deleting content, and logins, are logged with user, time and the old and new values. Admins and developers see the whole log; editors and authors see their own entries.
• Neleto staff access: our team accesses a site only to answer a support request or to run operations such as updates. Servers are reached only with SSH keys, never with passwords.

AI agents and permissions

AI agents connect to Neleto through its built-in MCP server. They don't get a special account or extra rights.

• Never more than the user. Every connection is bound to the user who approved it. An agent can do at most what that user's role allows.
• Narrow it down further. Under Profile → Security you can limit each API token and each connected app to specific permissions, for example read-only. The agent then gets only what both the role and the connection allow. Every MCP tool is mapped to a read or write permission; a tool without a mapping is refused.
• OAuth for Claude. Claude's custom connector signs in with OAuth 2.1 (authorization code flow with PKCE). Access tokens last one hour, and refresh tokens last 90 days and are replaced on every use. OAuth tokens work only for the MCP server, not for the rest of the API.
• API tokens for other tools. Cursor, Windsurf and other clients use a personal API token created under Profile → Security.
• Revoke at any time. Under Profile → Security → Connected applications you see every connected agent. Revoking one invalidates its tokens immediately, because tokens are checked on every request.
• Deletions are recoverable. What an agent deletes goes to the Restore page first, like any other deletion.
• Activity log: changes made by an agent are logged under the user who connected it.

Technical details: MCP server documentation.

Updates and releases

Neleto has had 119 releases since September 2023, 17 of them since July 2026. Every release is listed with its changes in the release notes.

Updates are included in every plan, and we install them for you. Database changes run automatically when a site starts on a new version. The MCP server supports protocol versions 2024-11-05, 2025-03-26 and 2025-06-18.

Leaving Neleto

Your content belongs to you.

• Export: ask us and we'll send you a complete export of your site's database and files. Everything is also available through the REST API and MCP, so you can script your own export.
• After cancellation: your site stays online until the end of the period you paid for. For 30 days after that, you can still ask for a complete export. Then your site and all of its data are deleted permanently. Copies in server backups are gone within seven days after that at the latest. On request we confirm the deletion in writing. Free sites are deleted as soon as you delete them, with the same seven days for backup copies.

Reporting a security issue

If you think you've found a vulnerability, write to security@neleto.io. We confirm receipt within one business day. Please don't publish details before we've had a chance to fix it.

The contact is also listed in /.well-known/security.txt.

Documents

• Privacy policy
• Terms of service
• EULA
• Imprint
• Data processing agreement (Art. 28 GDPR): on request at contact@neleto.io