Skip to content
Skip to content
WUBBERY● ENGINE LIVESign inStart a free shadow run

Trust

Who handles your data, and on what terms.

Everything on this page is in place today. Where something is not, we say so.

Sub-processors

The services that host and run WUBBERY.

Vercel
Hosts this website and the console. Its page-view measurement runs on the hosted site.Where: Vercel's global network
Google Cloud
Hosts the WUBBERY API and its stored state.Where: Australia (Sydney region)
Neon
The PostgreSQL database for accounts, keys and agreement records.Where: As set for our database; ask us
Stripe
Holds your card on file and issues invoices. We never see or store card numbers.Where: Stripe's regions
Google Firebase
Google sign-in.Where: Google's regions
Cloudflare Turnstile
The human check on the sign-in and sign-up forms, where it is switched on.Where: Cloudflare's network
Google Workspace
Sends our email, such as account verification, password resets and alerts, where it is set up.Where: Google's regions
Resend
Sends the same email when Google Workspace is not set up.Where: Resend's regions
Google Analytics
Site analytics, and only after you allow it. The console never loads it.Where: Google's regions

The AI provider you choose sees your requests because you send them there, under your own agreement with them. We do not sell personal information to anyone.

Security practices

What is in place today.

  • Card details never touch our servers. Cards are entered on the payment provider’s own page and held there.
  • Passwords are stored only as salted, slow hashes (scrypt), never in readable form.
  • Sign-in sessions use secure cookies that page scripts cannot read, sent only over HTTPS.
  • Two-factor sign-in with an authenticator app is available to every account, and required for every administrator.
  • HTTPS only. The site tells browsers to use an encrypted connection for every visit.
  • Requests that change data are checked for their origin, and sign-in attempts are rate-limited.
  • Visitor network addresses in data you send us are replaced with a one-way keyed hash before anything is stored. If that cannot be done, the data is refused rather than kept as sent.

Certifications

SOC 2: not yet certified.

We do not hold SOC 2 or ISO 27001 certification today and we do not claim either. When an independent report exists, it will be listed here with its date.

Found a security problem? Tell us, or write to hello@wubbery.com.

Documents