Compliance at Every Level
We've chosen infrastructure providers with rigorous security certifications so you can trust your data is protected.
GDPR Compliant
Full compliance with EU data protection regulations. Data stored in Europe region.
SOC 2 Infrastructure
Built on SOC 2 Type 2 certified providers: Supabase, Vercel, and Enterprise AI.
Data Encryption
All data encrypted in transit (TLS 1.3) and at rest (AES-256).
Security by Design
Security integrated into every layer of our architecture from day one.
Certified Infrastructure Partners
We carefully selected providers with independently audited security certifications.
Supabase
Database and authentication
Vercel
Application hosting
Polar.sh
Payment processing and subscription management
Stripe
Legacy payment processing
AI Model Providers
OpenAI, Google, Voyage AI (optionally xAI) — routed via Vercel AI Gateway and OpenRouter; API terms prohibit training on customer data
Our Security Practices
Beyond certified infrastructure, we implement comprehensive security measures.
Encryption in Transit
All connections secured with TLS 1.3. HTTPS enforced across all endpoints.
Encryption at Rest
Database encryption using AES-256. Backups encrypted and access-controlled.
Access Controls
Role-based access, MFA for team accounts, and granular permissions.
Regular Reviews
Ongoing security assessments and dependency vulnerability scanning.
Audit Logging
Comprehensive logging of access and changes for accountability.
Incident Response
Documented incident response procedures with defined escalation paths. We maintain an internal incident register with NIS2-aligned timelines for significant incidents (24h CSIRT early warning, 72h authority notification, final report within one month) and GDPR Article 33 personal-data-breach notifications to IMY within 72h.
AI & Data Handling
Transparency about how we use AI and handle your data.
No Model Training on Your Data
Your conversations and website content are NEVER used to train AI models. We use enterprise-grade AI models for generation, and your data stays out of their training pipeline.
RAG, Not Training
BubblaV uses Retrieval-Augmented Generation (RAG). Your content is stored in a vector database for retrieval, not used to modify AI model weights.
Data Deletion on Request
You can delete your website content and conversation history at any time. Deletion is permanent and removes data from all backups within 30 days.
Sub-processor Transparency
We disclose all sub-processors: AI Model Providers (OpenAI, Google, Voyage AI, and optionally xAI — routed via Vercel AI Gateway and OpenRouter), Supabase (database), Vercel (hosting), Polar.sh (payments), Stripe (legacy payments). Each has their own DPA.