Security

This page is maintained by Inuberry, Inc. to answer common security and privacy questions about Inuberry. It describes controls that are currently enabled in the product. It is not an independent certification.

Hosting and infrastructure

Inuberry runs on Lovable Cloud, which uses Supabase (Postgres) for database and authentication, and Cloudflare Workers for serverless compute. Customer data is hosted in managed cloud regions with provider-level physical security.

Encryption

• TLS 1.2+ for all data in transit.
• AES-256 (or equivalent) at rest, managed by the underlying cloud provider.
• Application secrets stored in managed secret stores; never in source.

Tenant isolation

Every multi-tenant table uses Postgres Row-Level Security policies scoped to the requesting user's organization membership. Cross-tenant reads are blocked at the database layer, not the application layer.

Authentication

• Email + password with leaked-password protection (HIBP) enabled.
• Google single sign-on.
• Password reset via signed one-time link.
• Customer Portal accounts are isolated from primary user accounts.

Authorization

Role-based access inside each organization (owner, admin, member, viewer) with separate role tables and security-definer helpers to prevent privilege-escalation through profile fields.

AI agents

AI agents run with the authenticated user's session and respect row-level security. Tool calls that mutate data can be gated behind an approval queue. Agent runs and tool calls are recorded in audit logs.

Monitoring and audit

• Application errors captured in a managed error-tracking system.
• Auth events and sensitive admin actions written to audit_logs.
• Billing events written to billing_events.

Vulnerability disclosure

Found a security issue? Email security@inuberry.com with a clear description and reproduction steps. We aim to acknowledge within two business days. Please do not publicly disclose until we have had a reasonable opportunity to remediate.

Backups and recovery

Daily automated backups are retained by our infrastructure provider. Restore drills are performed periodically.

Compliance

Inuberry is a young company; we do not currently hold third-party audit certifications such as SOC 2 or ISO 27001. A DPA is available on request.