Trust center
How we protect people's data
An honest overview for HR, IT, security and procurement teams. Where something is planned rather than done, we say so.
Architecture and security
- Hosting region
- Lovable Cloud on AWS us-west-2 (Oregon, United States). Regional hosting for other jurisdictions is not yet available.
- Encryption
- TLS for all traffic in transit; data at rest is encrypted by the hosting platform's managed storage and database.
- Row-level security
- Every table is default-deny. Sensitive participant data (check-ins, chats, journal, game results, career documents) is readable only by its owner.
- Employer reporting
- Only group totals from audited database functions: groups under 10 are hidden, a second cell is hidden when needed to stop back-calculation, values are rounded to 5, and date filters snap to whole months.
- Roles
- Roles live in a protected table and are checked on the server for every action. The browser is never trusted for role or organisation.
- Safety design
- A rule-based crisis check runs before any AI model call. It shows fixed crisis resources (US 988 / 911; local emergency services elsewhere). Employers are never notified.
- Audit
- Admin actions and every employer report query are logged. Employer admins can export their own organisation's admin audit log.
- Sign-in
- Email, Google and Microsoft sign-in today. SAML/OIDC enterprise SSO is available on request.
Subprocessors
| Subprocessor | Purpose | Location / status |
|---|---|---|
| Lovable Cloud (built on Supabase) | Hosting, database, authentication, file storage | United States (AWS us-west-2, Oregon) |
| AI model providers via Lovable AI Gateway | AI coach and AI tools responses | Requests processed by the gateway's model providers; workspace uses zero-retention endpoints where available |
| Email delivery provider | Invitations and notifications | Not yet enabled — pending domain setup |
Data rights
Participants can download all their data, delete it, revoke any sharing and see who can see what at any time. Employers set a data-retention period per organisation. See Who can see what.
Compliance roadmap
REBOUND does not currently hold any security or privacy certification.
| Item | Status | Notes |
|---|---|---|
| SOC 2 Type II | Planned | Not yet audited. No SOC 2 report exists today. |
| ISO/IEC 27001 | Planned | Not certified. Planned after SOC 2 readiness. |
| Independent penetration test | Planned | Not yet performed; internal automated security scans run on each release. |
| Data Processing Agreement (DPA) | Draft available on request | Template under legal review. |
| GDPR / UK GDPR | Design aligned — legal review pending | Data minimisation, access, export and deletion are built in; formal legal review not yet complete. |
| HIPAA | Not a covered service | REBOUND is not a healthcare provider or treatment service and does not process protected health information as a covered entity or business associate. |
| External accessibility audit (WCAG 2.2 AA) | Planned | Automated axe checks show zero violations on tested pages; an external audit is pending. |