Security at Espobase

• Espobase is not SOC 2 certified and is not HIPAA compliant. We don't sign Business Associate Agreements (BAAs).
• Don't store health information covered by HIPAA, payment card numbers or other data that requires a certified provider: our Terms don't allow it.

• All traffic to the website, the dashboard and the APIs uses HTTPS.
• Backups are encrypted (AES-256-GCM) before they leave our server.
• Database passwords, signing keys and other secrets are stored encrypted (AES-256-GCM).

• Passwords are stored only as one-way hashes (Argon2id), for your Espobase account and for your app's users.
• API keys and access tokens are stored only as keyed hashes, and shown once, when you create them.
• Secret API keys are refused when they come from a web browser, so they can't leak through a front end by mistake.

• Row level security is on by default for every new table: nothing can be read with a publishable key until you add a rule.
• Each project has its own database, isolated from other projects.
• Security rules are shown as SQL for you to review before they're applied, and changes proposed by the AI are never applied without your approval.

• Every project database is backed up daily. A backup only counts once it has been downloaded again, decrypted and verified.
• Backups are kept 1 day (Free), 7 days (Pro) or 14 days (Group), and are locked against deletion for 7 days.

• Email verification, password reset, and sign-in with GitHub, Google or Apple.
• Roles for organization members (owner, admin, developer, viewer) and access to selected projects only.
• Single sign-on (SSO) and an audit log of security-sensitive actions on the Group plan.
• Personal access tokens are limited to the permissions you choose, and always expire.

• The website, the dashboard and the APIs are checked from outside every 5 minutes: see the live status page.
• Only the web entry point is reachable from the internet: databases and internal services are never exposed.
• We're alerted automatically when a service goes down.

Project databases and APIs run in the United States (Boston). Uploaded files and backups are stored with Cloudflare R2 in North America. Details are in our privacy policy.

If you think you've found a vulnerability, email support@espobase.com with the details and the steps to reproduce it. Please don't access other people's data or disrupt the service while testing. We'll reply and keep you updated until it's fixed.