Security & Trust

This page describes the security controls ihubb operates today. It's a plain-English summary — not a formal certification.

Tenant isolation

Every row in every table is scoped to a workspace. Row-level security policies are enforced at the database layer — not just the app.

Encryption in transit

All traffic between your browser and our servers is TLS 1.2+. Certificates and documents travel over HTTPS end-to-end.

Private document storage

Uploaded certificates are stored in a private bucket. Files are accessible only through short-lived signed URLs scoped to the requesting workspace.

Audit log

Every create, update, close-out and evidence upload is recorded with actor, timestamp and payload. Exportable on demand.

Least privilege

Admin, manager, contributor and viewer roles — enforced both in the UI and by database policies. Suppliers only ever see their own review link.

Subprocessors

Hosting & database: Lovable Cloud. Payments: Stripe. AI extraction: Google Gemini via Lovable AI Gateway. Email: sent from a verified domain we control.

Data handling

ihubb is the data processor for the information you and your team upload. You remain the data controller. We process personal data (names, email addresses, certificate holder details) solely to provide the service.

You can export your data at any time from your workspace settings. On account closure, your data is retained for 30 days then permanently deleted, unless you request earlier deletion.

Report a vulnerability

Please email security@compliancebuddy.example. We aim to acknowledge reports within one business day.