Trust Center
Last reviewed: July 2026
Hubity is built with enterprise-grade security at its core. This page documents how we protect your data, who is responsible, and what your rights are.
Active
Encrypted when stored
Active
Encrypted when sent
Available
Two-step sign-in
Active
Activity log
Active
Privacy rights
In Progress
SOC 2 (in progress)
Our Commitment
CoreSecurity is not an afterthought at Hubity. It runs through the whole product: extra encryption on sensitive information, files that open only for people allowed to see them, and permissions set role by role. We hold ourselves to the same standard we help our customers hold their own data to.
Data Encryption
Active Encrypted when stored: All of your data is encrypted while it is stored, with AES-256, the standard most banks and governments use
Extra protection for sensitive information: Sensitive information such as salary and personal details gets a second layer of encryption with its own separate key, and you have to confirm it is you again before any of it will open
Encrypted when sent: Everything traveling between you and Hubity is encrypted with TLS 1.3, the current standard, and any connection that is not encrypted is refused
Encryption keys: The keys that unlock your data are kept separate from the data itself, and can be replaced without changing anything that is stored
Email privacy: Email addresses are encrypted while stored, with extra protection so they stay unreadable even if someone reached the stored files
File access: A file opens only for someone who is signed in and allowed to see it. There is no direct link that would let anyone else reach it
Authentication
Active Passwordless login: We email you a sign-in code that expires in 15 minutes. There is no password to steal or guess
Passkeys: Sign in with your fingerprint, your face, or a hardware security key
Two-step sign-in: Use an authenticator app for a second step at sign-in. The setup secret is stored encrypted, and your backup codes are stored in a form that cannot be read back
Sign in with your company account: Sign in with the Google or Microsoft work account your team already has, including Microsoft Entra ID, so there is one company login to manage
Staying signed in: Your sign-in is stored encrypted, cannot be used by another website to act as you, and expires on its own
Confirm it is you again: Sensitive information such as salary and personal details opens only after you confirm it is you again, even when you are already signed in
Hosting and Storage
Active Hosting: Enterprise-grade hosting that switches over automatically if something fails, serves people quickly wherever they are, and updates without taking Hubity offline
Stored records: Your records are stored encrypted, backed up continuously, and can be restored to any point in time
Protection from attacks: Enterprise-grade blocking of attacks that try to flood Hubity with traffic, filtering of automated bots, and pages served from close to wherever you are
Data isolation: Each company's data is kept separate, and nothing you store can be reached from another company's account
File storage: Documents are stored encrypted, and they open only for someone who is signed in and allowed to see them
Access Control
Active Role-based access control: Granular, least-privilege roles govern every action. Duties are separated: a dedicated IT and security administrator role manages authentication, integrations, and audit without access to HR, finance, or pay data, and a finance role is scoped to financial data without company-administration powers
Activity log: Every significant action is recorded in an activity log, together with the device and network address it came from, in a way that makes any later change to a record detectable. Records are kept for at least six years
Limits on repeated attempts: Sign-in attempts and sensitive actions are limited in number, so they cannot be used for repeated guessing or abuse
Checks on everything sent in: Everything sent to Hubity is checked on our own systems, not just in the browser, including the type and format of every uploaded file
Application Security
Active Browser protections: Strict browser rules stop outside code from running inside Hubity or loading anything we have not approved
Sensitive data detection: Hubity spots Social Security numbers, credit card numbers, passwords, and access codes in what you add to your knowledge base. Live sign-in details are blocked outright, and other sensitive information is set aside so the AI never reads it
Outside software we rely on: The outside software Hubity is built on is tracked and updated regularly. Security advisories are reviewed and acted on promptly
Error handling: You never see internal error details. Problems are recorded securely for our own review
Data Handling
Active Data residency: Data is primarily processed and stored in the United States. EU data residency is available on Enterprise plans
Data minimization: We only collect data required to provide the service. No behavioral tracking beyond product analytics
AI companies we use: Questions sent to the AI companies we work with are not kept once the answer comes back, and are never used to train any model
Deletion: Customer data is deleted after account cancellation in line with our Data Processing Agreement, and backups age out on a rolling schedule thereafter
Compliance
In Progress European Privacy RightsActive
Access, correction, deletion, and data export rights supported
California Privacy RightsActive
Consumer privacy rights honored including right to know, delete, and opt out
Sensitive Data ProtectionActive
Extra encryption on sensitive information, access only for signed-in people, and activity records kept for years
SOC 2 Type IIIn Progress
The companies that host Hubity are certified. Our own assessment is in progress
Accessibility
Hubity is committed to meeting recognized accessibility standards across all user-facing surfaces.
Keyboard navigation: All interactive elements are reachable via keyboard with visible focus indicators
Screen reader support: Everything is labeled so a screen reader can announce it, including content that updates while you are on the page
Correct page structure: Headings in order, clearly marked page regions, and a label on every field
Color contrast: Text and on-screen elements meet WCAG AA contrast levels in both light and dark themes
Skip navigation: Skip-to-content link provided for keyboard users to bypass repetitive navigation
Responsive design: Fully usable on mobile, tablet, and desktop with touch and pointer input support
To report an accessibility barrier, contact [email protected].
Vulnerability Disclosure
We welcome responsible security research. If you discover a vulnerability, please report it to [email protected].
Response time: We acknowledge all reports within 48 hours
Safe harbor: We do not pursue legal action against good-faith researchers
Recognition: Valid vulnerability reporters are acknowledged with permission
In scope: hubity.io and its associated services
Out of scope: Third-party services, social engineering, denial-of-service
Our full security policy is published at /.well-known/security.txt
Connected app security
ActiveWe check our controls against the public OWASP MCP Top 10 framework for connected app and agent security.
1 Access codes leakingMitigated
Access codes are stored in a form that cannot be turned back into the original. Saved sign-in details are encrypted, separately for every record. A code is shown once when it is created and can never be retrieved again. Codes never appear in a log or in any error message.
2 A connection gaining more access than it shouldMitigated
Each connection is limited to what it needs, and is read-only unless you say otherwise. Every connected app is restricted to a named list of actions. Anything that writes or changes data needs approval, and sensitive actions need two people.
3 A connected app returning something harmfulMitigated
Everything a connected app sends back is scanned for hidden instructions, attempts to run commands, and attempts to pull data out, before any of it is stored or shown. What each connected app is allowed to do must be approved by an administrator.
4 Tampering with the software or data we rely onMitigated
Everything that comes in is signed, so we can prove where it came from and tell whether it changed on the way. Connected apps are monitored continuously and cut off automatically if they start failing.
5 Hidden commands being runMitigated
Everything sent in is checked on our own systems before it is used. Database lookups cannot be rewritten by what a connected app sends. Nothing a connected app sends can run commands on our systems. Content is scanned for threats even when it arrives disguised.
6 Hidden instructions aimed at the AIMitigated
Content from a connected app is scanned for hidden instructions before the AI reads it. Sensitive and restricted content is left out of what a connected app can see, and there is a limit on how much any one response can return.
7 Someone connecting who should not be able toMitigated
Connections are authorized through a current industry-standard sign-in flow, and an access code works only from the connection it was issued to. Your company can sign in with its own company account. Every code is checked against our records at the moment it is used, and each company's data stays separate at every level.
8 No record of what happenedMitigated
Every action, every access code used, and every access decision is recorded, in a way that makes any later change to the log detectable. Signed export bundles are available for an outside compliance review.
9 Connections nobody approvedMitigated
Adding a connected app requires manager-level approval. Every connected app is listed in your company's inventory and monitored. Unused ones are flagged automatically. No connection ever uses a default or shared password.
10 The AI seeing more than it shouldMitigated
One company's data can never be reached from another company's account. Sensitive, confidential, and health information is left out of every response, and personal details are found and hidden automatically.
Security Contact
For security inquiries, compliance questions, or to report a concern:
Hubity
[email protected]
Doing an enterprise security review? Ask for our security package (our SOC 2 report when it is available, the Data Processing Agreement, and completed security questionnaires) under a nondisclosure agreement, at the address above.