Security and data protection

Organisations are separated by the database itself

Every row of customer data carries the mark of the organisation it belongs to, and every query runs under a database role that may only see that organisation. That is row-level security: if a programmer forgets the filter, the database returns zero rows instead of another customer’s.

The application deliberately connects as a role without superuser rights. On start-up the server checks this itself and refuses to run if that role may do too much.

Where the data lives

Processing and storage happen in the European Union at [hosting provider], including backups. No customer data leaves the EU, except where you switch on a channel or connector whose supplier runs elsewhere; those are listed under sub-processors.

Encryption

Traffic runs over TLS. Mailbox passwords, connector API keys and tokens are stored encrypted, with keys that can be rotated without re-entering the data. Secrets stay out of logs; log lines contain no message content.

What the language model does and does not see

The model receives the customer’s message, the approved knowledge that matches the question, and the organisation’s settings. Nothing more: no conversations from other organisations, and no knowledge that has not been approved.

Patterns that look like bank account numbers, national identity numbers or passwords are detected and masked before anything reaches the model. Your conversations are not used to train third-party models; that is contractually agreed with the supplier.

Access, roles and trail

Colleagues have a role: owner, admin or agent. What each may do is enforced on the server, not only in the screen. Invitations expire; sessions expire.

For every answer it is recorded which knowledge fragments fed it, which model wrote it, how certain it was and who sent or changed it. For every action in an external system it is recorded who or what started it, with which values, what came back and who signed off.

Actions in your systems

A connector stores its key encrypted and is only used for the actions you switched on yourself. Every action has a risk class. Reading is allowed sooner than writing; irreversible actions always pass a human, even at the highest autonomy level. Above an amount you set, a human always signs.

What we do not have yet

Hubbery has no ISO 27001 or SOC 2 certification yet, and no external penetration test has been carried out. Both are planned; until then we say so here rather than talking around it. Ask in the sales conversation and you will hear where it stands that day.

Reporting a vulnerability

If you find a weakness, email support@hubbery.nl. We confirm within two working days and keep you posted until it is fixed. We will not take legal action against anyone who reports responsibly and touches no more data than needed to demonstrate the problem.