Security at 1hub

• All traffic is encrypted in transit with TLS; HTTPS is enforced with HSTS.
• Ingested artifact content is envelope-encrypted at rest with a dedicated key, on top of full-disk encryption at the infrastructure layer.
• Databases and file storage are encrypted at rest by our infrastructure providers.

• Every database query is scoped by row-level security: a workspace can only ever read its own data, enforced at the database layer, not just in application code.
• Client portals are private by default. Access is invite-only, password-gated, or link-based at your choice, with per-report permissions on top.
• Portals send no-index directives, so client work never appears in search engines.
• Untrusted artifact HTML runs in a fully sandboxed frame on a separate origin, with no access to sessions, cookies, or other tenants.

1hub runs on audited, industry-standard infrastructure: application hosting on Vercel and database/auth/storage on Supabase — providers that maintain SOC 2 Type II and comparable certifications for the layers they operate. Payments are processed by Polar as merchant of record; card data never touches our systems.

• Passwordless sign-in with one-time links (plus optional passwords); portal password attempts and sign-in emails are rate-limited.
• Security headers across the product: HSTS, frame-embedding denial on trusted pages, content-type sniffing protection, and a restrictive permissions policy.
• Short-lived signed tokens gate every artifact view; nothing is served from guessable public URLs.
• Service credentials are held server-side only and never shipped to browsers.

• You own your content; we process it only to operate the Service (see the Privacy Policy).
• Deleting your account deletes or de-identifies your data, except where retention is legally required.
• Sub-processors are limited to the providers needed to run the Service; a current list is available on request.

If we become aware of a breach affecting your data, we will notify affected customers without undue delay, with what we know and what we're doing about it. Security researchers: please report vulnerabilities to support@1hub.work — we commit to acknowledging reports quickly and not pursuing good-faith research.

We're early, and honest about it: 1hub does not yet hold its own SOC 2 certification. Our controls are designed along those lines (least-privilege access, tenant isolation, encryption everywhere, auditable infrastructure), and formal certification is on our roadmap as the business grows. If your organization needs a security questionnaire completed or a DPA signed, contact us — we're happy to do both.