Compliance at Every Level
We've chosen infrastructure providers with rigorous security certifications so you can trust your data is protected.
GDPR Compliant
Full compliance with EU data protection regulations. Data stored in Europe region.
SOC 2 Infrastructure
Built on SOC 2 Type 2 certified providers: Supabase, Vercel, and Enterprise AI.
Data Encryption
All data encrypted in transit (TLS 1.3) and at rest (AES-256).
Security by Design
Security integrated into every layer of our architecture from day one.
Certified Infrastructure Partners
We carefully selected providers with independently audited security certifications.
Supabase
Database and authentication
Vercel
Application hosting
Stripe
Payment processing
AI Model Providers
Foundation models (via Vercel Gateway)
Our Security Practices
Beyond certified infrastructure, we implement comprehensive security measures.
Encryption in Transit
All connections secured with TLS 1.3. HTTPS enforced across all endpoints.
Encryption at Rest
Database encryption using AES-256. Backups encrypted and access-controlled.
Access Controls
Role-based access, MFA for team accounts, and granular permissions.
Regular Reviews
Ongoing security assessments and dependency vulnerability scanning.
Audit Logging
Comprehensive logging of access and changes for accountability.
Incident Response
Documented incident response procedures with defined escalation paths.
AI & Data Handling
Transparency about how we use AI and handle your data.
No Model Training on Your Data
Your conversations and website content are NEVER used to train AI models. We use enterprise-grade AI models for generation, and your data stays out of their training pipeline.
RAG, Not Training
BubblaV uses Retrieval-Augmented Generation (RAG). Your content is stored in a vector database for retrieval, not used to modify AI model weights.
Data Deletion on Request
You can delete your website content and conversation history at any time. Deletion is permanent and removes data from all backups within 30 days.
Sub-processor Transparency
We disclose all sub-processors: AI Model Providers (e.g. Google Gemini), Supabase (database), Vercel (hosting), Stripe (payments). Each has their own DPA.