Erbacci LTD · All processing runs in a single AWS account (region eu-west-1). TimeStack captures still snapshots only — no live video, no audio, no AI/analysis. Encryption: TLS 1.2+ in transit, AES-256 at rest.
Account linking (one-way): Ring posts an OAuth code to our Token Exchange URL; we exchange it for access/refresh tokens and store them encrypted; Ring then redirects the user to our Account Link URL, where they sign in before nonce matching completes the integration.
| Data | System / location | Protection | Retention |
|---|---|---|---|
| Camera snapshots (JPEG) | Amazon S3 — captures/ (eu-west-1, private bucket, public access blocked) | SSE AES-256 at rest; TLS in transit | Auto-deleted after 180 days |
| Time-lapse reels (MP4) | Amazon S3 — reels/ (eu-west-1, private) | SSE AES-256; served only via short-lived presigned URLs | Auto-deleted after 365 days |
| Account metadata, project config, Ring OAuth tokens | Amazon DynamoDB (eu-west-1) | Encryption at rest; least-privilege IAM; tokens purged on unlink | Until account deletion / unlink |
| Application & access logs | Amazon CloudWatch / CloudTrail | Within the AWS account; least-privilege access | ~30 days |
No customer data leaves AWS. Sole sub-processor: Amazon Web Services (AWS), governed by the AWS DPA. Contact: info@erbacciltd.com.