How we protect your data and your apps' data
A simple explanation of what happens to your data in Webbe. This page isn't a legal document; the binding details are in the privacy policy.
Where data is stored
- The database, sign-in and files are with Supabase, in the European Union region.
- The platform and published apps are hosted on Vercel. Requests may pass through its network in different countries to arrive faster.
Each app's data is isolated
- Each app's data is separated by security rules inside the database itself, at the level of every record.
- No app can reach another app's data, and users only see what their role in the app allows.
- Each record has a visibility you set: public for visitors, members only, or private to its owner and the admin.
Your apps' user accounts
- Anyone who signs up to your app becomes a member with a set role: owner, supervisor, staff, customer or member, and supervisors get permissions set by the owner.
- Sign-in is with Google, so your app doesn't store its users' passwords.
- Membership in one app gives no permission on another app, or on your Webbe account.
- You manage users and their roles from the app dashboard.
Only the app's owner can publish
- Uploading publish files is allowed only for the app's owner, by permission rules in storage.
- No one else can change the published version of your app.
Encrypted connections
- All Webbe pages and published apps run over HTTPS, so data travels encrypted between the browser and the server.
Security added automatically to every app you create
No security expertise needed: these protections work in every app published on Webbe, from the first publish.
Permissions enforced by the database
Products, prices, coupons and app settings can only be changed by the app's owner or its admins. The protection is inside the database itself, so no one can bypass it even by editing the code in their browser.
A protected admin panel
Your app's admin panel opens for the admin only, and their role is stored in the database, not in the browser. You enter it straight from Webbe without a password.
Secure sign-in with Google
Your app's users sign in with Google, so your app stores no passwords and benefits from Google's protection of their accounts.
Payments whose amount can't be tampered with
Your payment provider key is stored encrypted on Webbe's server and never reaches the browser. We calculate the amount on the server from your product prices and coupons, and confirm the payment succeeded directly with the provider.
Clickjacking protection
Your app can't be shown inside a frame on another website, so no one can trick your visitors with hidden buttons over your pages. And your app only accepts editor commands from Webbe.
Encrypted even on your domain
Every published app runs over HTTPS, with a certificate issued and renewed automatically when you connect your own domain.
What we don't do
- We don't sell your data or your apps' users' data.
- We don't use your data for advertising, and we don't use advertising tracking cookies.
- We only share your data with the service providers listed here to run the platform, or when the law requires us to.
What we recommend
- Turn on two-step verification for the Google account you use to sign in to Webbe.
- Don't write passwords, secret keys or sensitive data in your app's description or the chat.
- Payments inside apps are currently in test mode, so don't ask your customers for their real card details.
- Review table visibility in the app dashboard, and keep orders and bookings private.
- Export your app's files from time to time to keep a copy.
Plainly: Webbe is a young platform, and we don't yet hold independent security compliance certifications. We rely on well-known infrastructure providers and apply what's on this page. No system is perfectly secure, and we'll tell you if a security incident affects your data.
Found a security issue?
Email us at mixsquare41@gmail.com with a description of the issue and steps to reproduce it, and we'll follow up as a priority.