Enterprise SecuritySOC 2 Type 2 infrastructure · EU data region
Security & compliance
you can trust
Built on enterprise-grade infrastructure from SOC 2 Type 2 certified providers. We protect your data with industry-leading security practices and full GDPR compliance.
At a glance
- Data region
- EU · Stockholm, Sweden
- In transit
- TLS 1.2+, TLS 1.3 preferred
- At rest
- AES-256
- AI model training
- Never on your data
- Infrastructure
- SOC 2 Type 2 providers
- Breach notice
- Within 72 hours
Built on
- Cloudflare
- Supabase
- Anthropic
- Polar.sh
Compliance at every level
We've chosen infrastructure providers with rigorous security certifications so you can trust your data is protected.
GDPR compliant
Full compliance with EU data protection regulations. Data stored in Europe region.SOC 2 infrastructure
Built on SOC 2 Type 2 certified providers: Cloudflare, Supabase, and Enterprise AI.Data encryption
Data encrypted in transit (TLS 1.2+, TLS 1.3 preferred) and at rest (AES-256).Security by design
Security integrated into every layer of our architecture from day one.
Certified infrastructure partners
We carefully selected providers with independently audited security certifications.
- Cloudflare
Application hosting, network and email delivery
SOC 2 Type 2, ISO 27001CloudflareVerify certificationApplication hosting, network and email delivery
SOC 2 Type 2, ISO 27001 - Polar.sh
Payment processing and subscription management
—Polar.shPayment processing and subscription management
— - AI Model Providers
Anthropic (primary), Google, Voyage AI and TypeSafe AI, with OpenRouter as the fallback to OpenAI and Google models; API terms prohibit training on customer data
Varies by providerAI Model ProvidersVerify certificationAnthropic (primary), Google, Voyage AI and TypeSafe AI, with OpenRouter as the fallback to OpenAI and Google models; API terms prohibit training on customer data
Varies by provider
Our security practices
Beyond certified infrastructure, we implement comprehensive security measures.
Encryption in transit
All connections secured with TLS 1.2 or higher, TLS 1.3 preferred. HTTPS enforced across all endpoints, with HSTS.Encryption at rest
Database encryption using AES-256. Backups encrypted and access-controlled.Access controls
Role-based access, MFA for team accounts, and granular permissions.Regular reviews
Ongoing security assessments and dependency vulnerability scanning.Audit logging
Comprehensive logging of access and changes for accountability.Incident response
Documented incident response procedures with defined escalation paths. We maintain an internal incident register with NIS2-aligned timelines for significant incidents (24h CSIRT early warning, 72h authority notification, final report within one month) and GDPR Article 33 personal-data-breach notifications to IMY within 72h.
AI & data handling
Transparency about how we use AI and handle your data.
RAG, not training
- Your website content
- Stored as vectors in the EU
- Retrieved per question
- Grounded answer for the visitor
- Never happens:Used to train AI models
No model training on your data
Your conversations and website content are NEVER used to train AI models. We use enterprise-grade AI models for generation, and your data stays out of their training pipeline.
RAG, not training
BubblaV uses Retrieval-Augmented Generation (RAG). Your content is stored in a vector database for retrieval, not used to modify AI model weights.
Data deletion on request
You can delete your website content and conversation history at any time. Deletion is permanent and removes data from all backups within 30 days.
Sub-processor transparency
We disclose all sub-processors on our GDPR page, including the AI model providers (Anthropic, OpenRouter, Google, Voyage AI, TypeSafe AI, OpenAI), Cloudflare (hosting and email), Supabase (database), Ably (realtime messaging), Sentry (error monitoring), Polar.sh (payments) and Stripe (legacy payments). Each has their own DPA.
Questions about security?
Our team is happy to discuss security requirements and provide additional documentation for enterprise customers.