Security
Your data belongs to you. We guard it like the apple of our eye.
You put strategy, know-how and texts into AuthorityHub that competitors must not see. On this page we explain how we handle the data, who can access it and how artificial intelligence handles it.
Updated 29 October 2026
Our commitments
Six things you can rely on
Data stored in the EU
The database and files are hosted in a data centre in Paris.
No AI training
We do not use your data to train AI models, and our contracts forbid our providers to do so.
Customers kept apart
Each company's data is available only to its own account. No other customer can see it.
Encryption
In transit and at rest. Access credentials for connected services are stored encrypted.
We don't sell data
We do not share it for advertising and do not provide it to anyone for payment.
Control over your data
After the contract ends we keep your data for 30 days so you can take it over, then delete it permanently.
01 / Infrastructure
Where the data is stored
AuthorityHub runs on the Lovable Cloud platform with a Supabase database. Application data is stored in the EU, in a data centre in Paris.
- The platform operator is certified to SOC 2 Type II and ISO 27001.
- The database, files and backups are encrypted; all communication runs over HTTPS only.
- Data is backed up regularly.
- Uploaded files are stored privately and cannot be opened via a public address.
02 / Access
Data separation and access
Every record in the database belongs to a specific account. Rules enforced in the database itself make data available only to its owner, even if the application had a bug.
- Data separation rules apply to every database table and to file storage.
- Server functions verify sign-in and ownership of every brand, project and document.
- Agencies keep client accounts separated by brand.
- In October 2026 we carried out a security audit of all server functions focused on the separation of customer data.
03 / Account
Sign-in and two-factor authentication
You can turn on two-factor authentication with a code from an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password and others).
- With it turned on, nobody reaches your data without the code — neither through the interface nor directly in the database.
- One-time recovery codes in case you lose your phone; attempts to guess them are limited.
- Passwords are never stored in readable form.
- Per-account request limits protect the service against abuse.
04 / Artificial intelligence
AI and your data
Texts, graphics and transcripts are created with models from OpenAI, Google and Anthropic, called through a secured interface. Neither your inputs nor your outputs are used to train models.
- AI providers are contractually prohibited from using the data for training.
- We do not store Thought Leadership voice recordings at all: we transcribe them and delete them.
- Outputs created for you are never made available to other customers.
- Processing in AI models may take place outside the EU (USA), always under the EU Standard Contractual Clauses.
05 / Connections
Connected accounts and web content
You connect social networks, websites and email marketing to each brand separately. Credentials are stored encrypted and used only on the server; they never reach the browser.
- Nothing is sent without your approval; newsletters are created as drafts.
- You can disconnect any connection at any time.
- Web content for creation is fetched only from domains whose ownership you have verified. Competitors' content cannot be used for creation.
- The E-E-A-T analysis reads public pages only; private and internal addresses are blocked.
06 / GDPR
GDPR and processors
We process account data as a controller and personal data in your content as a processor under Art. 28 GDPR. The processing clause is part of the terms and conditions.
- The list of sub-processors is in Art. 12.5 of the terms; we inform you of changes in advance.
- Transfers outside the EU and EEA only under Chapter V GDPR, typically Standard Contractual Clauses.
- We notify you of a personal data breach without undue delay and no later than 48 hours after discovering it.
- After the contract ends we keep your data for 30 days so you can take it over, then delete it permanently.
FAQ
What customers ask
Can another customer see our strategy or texts?
No. Data is separated in the database by rules that make it available only to your account, and the same applies to files in storage.
Do you train AI on our data?
No. We do not use your inputs or outputs for training, and contracts prohibit the AI model providers from doing so.
Where are the data servers physically located?
The database and files are in a data centre in Paris (EU). Processing in AI models may take place in the USA, under the EU Standard Contractual Clauses.
Who at AuthorityHub can access the data?
Only the operator, to the extent necessary to run and support the service. All administrator functions verify permissions on the server.
Do you store voice recordings?
No. We transcribe the recording and delete it; it is stored neither in the database nor in file storage.
What happens to our data when we stop using the service?
After the contract ends we keep it for 30 days so you can take it over, then delete it permanently.
Do you have a data processing agreement?
Yes. The processing clause under Art. 28 GDPR is part of the terms and conditions (Art. 12) and you accept it together with them.
How do I report a security issue?
Email info@brandhub.cz with the subject “Security”. We will reply as soon as possible and keep you informed about the fix.
Security question or vendor questionnaire?
Write to us. We will fill in your IT team's security questionnaire and answer questions about data protection.
Build authority across every channel from one place
AuthorityHub is in beta. Leave your email and we’ll let you know as soon as we open access for testing.
View pricing