Built to protect what matters.

Production database: Supabase Pro, EU-hosted (eu-west-1, Ireland). Your data at rest in our production database is stored in the EU. Some of the subprocessors listed below, such as the AI providers, process data in other regions; the Privacy Policy lists the subprocessors and international transfers. Supabase provides a Data Processing Agreement (DPA) and is GDPR-compliant by design.

Application servers: AWS EC2 (eu-west-1, Ireland). The web application runs in the same EU region as the database. Dev and production use separate environments and separate Supabase projects. Dev data never reaches the production database.

We are planning to migrate application serving to Vercel edge infrastructure before the first paying customer onboards. When that changes, this page will be updated with the new region configuration.

Encryption at rest: AES-256. All data stored in the Supabase database is encrypted at rest using AES-256, the same standard used by financial institutions and healthcare systems.

Encryption in transit: TLS. All traffic between your browser and BABA is encrypted in transit via TLS. No data moves over plain HTTP.

Org-scoped isolation at the database layer. Every table is protected by Row-Level Security (RLS) policies enforced directly in PostgreSQL, not just in application code. A user in one organization cannot read or write data from another organization, even if application-layer logic were bypassed.

Role-based access within your organization. Owners see everything. Admins see their department scope. Staff members see their own records. These permissions are enforced at both the application layer and the database policy level.

BABA staff access. We do not browse customer data routinely. BABA staff can only access your data when you explicitly share a conversation with us (e.g., for a support request), or when required by law.

GDPR: live. BABA operates under GDPR requirements today. Data is EU-hosted, a DPA is in place with Supabase, and data subject requests (access, deletion, export, correction) are processed within 30 days. See our Privacy Policy and Data Transparency page for the full picture.

Healthcare and HIPAA. Healthcare and compliance-driven businesses are a core audience for BABA. BABA does not store Protected Health Information (PHI), and we do not claim HIPAA compliance. We do not have a HIPAA Business Associate Agreement (BAA) in place today, and none will be signed or relied on until the controls behind it are in place. Please do not enter PHI into BABA. If you run a healthcare practice and need to understand the data boundary before using BABA, talk to us first.

SOC 2: pre-audit. A SOC 2 Type II audit is on the compliance roadmap for post-launch. We are actively building toward the control requirements (access controls, logging, incident response), but we have not yet completed an audit. We will not claim SOC 2 certification until we have one.

We do not train AI models on your business data. Your conversations with the BABA AI Guide are used to generate responses in your session. They are not used to retrain or fine-tune any AI model, ours or anyone else's.

What we send to Anthropic. AI responses are generated via Anthropic's API. Depending on how you use the BABA AI, this can include what you type, content from documents you upload, and, when Ask Baba answers a question about your connected accounting, payroll, or other integration data, the relevant records pulled from that integration. That content may include names, emails, or other identifiable personal data. Anthropic's data handling is governed by Anthropic's Privacy Policy.

We do not sell your data. Ever. To anyone. Not to data brokers, advertisers, or investors. Investor updates contain aggregate, anonymized metrics only.

BABA uses the following third-party subprocessors. Each has its own security and privacy obligations as part of our vendor relationships:

• Supabase: database and authentication (EU-hosted, DPA in place)
• Amazon Web Services (AWS): application hosting (eu-west-1, Ireland)
• Anthropic: AI response generation (API access; may receive identifiable personal data contained in your messages, documents, or connected-integration data)
• Voyage AI: text embeddings for cross-session memory and document search (API access; may receive identifiable personal data contained in that content)
• Stripe: payment processing for BABA’s own subscription billing, receiving your email address and an opaque internal reference (not your name or organization ID; we do not store card data; Stripe is PCI DSS Level 1 certified)
• Sentry: error monitoring (application error logs; no business data)
• Axiom: log aggregation (structured application logs; pseudonymous identifiers only, no message content)
• PostHog: product analytics (pseudonymous identifiers only, no message content)
• Resend: transactional email delivery (recipient address on every send; some senders may carry a client’s name or other identifying content)
• Upstash Redis: rate limiting and short-lived caching of Ask Baba tool results and accounting-integration reports (no durable retention; expires automatically)

For the data your organization enters or connects, your organization is the data controller and BABA is its data processor; the subprocessors above act under our instructions. BABA is the controller for the data of account holders and website visitors, such as sign-in, billing and analytics data. The roles are set out in the Data Processing Terms and the Privacy Policy.

If you discover a security vulnerability in BABA, please report it to us directly before public disclosure. We take all reports seriously and respond within 2 business days.

security@babamethod.com

Please include: the type of vulnerability, a description of the potential impact, and steps to reproduce. We will work with you to verify and address the issue before coordinated disclosure.