How we protect your data
Zipplee (and our benefits-communication product, Zipplee) is operated by Custom Ai Apps LLC. We hold employee and HR-adjacent content for the companies we serve, and we take that responsibility seriously. This page explains — honestly — how that data is secured, where it lives, who processes it, and where we are on our compliance roadmap.
Encryption
All data is encrypted in transit and at rest.
- In transit: every connection to our applications and APIs is served over TLS/HTTPS. Traffic between your browser and our infrastructure is encrypted end to end.
- At rest: your data is stored on encrypted disks. Encryption at rest is managed by our infrastructure providers (Supabase on Amazon Web Services), using industry-standard AES-256 disk encryption.
Tenant isolation
Every customer ("tenant") is logically separated from every other customer at the database level. We enforce this with PostgreSQL Row-Level Security (RLS).
In plain language: each row of data in our database is tagged with the company it belongs to. Row-Level Security is a rule, enforced by the database itself, that checks the identity of whoever is asking before any data is returned — and only ever hands back rows that belong to that requester's company. There is no code path a customer can take to read another customer's data, because the database refuses the request, not just the application. This isolation is applied to every customer-facing table.
Authentication
Access to your workspace is protected by JWT-based authentication. When a user signs in, they receive a short-lived, signed token (a JSON Web Token) that the system verifies on every request. That token also carries the user's identity into the Row-Level Security checks described above, so authentication and data isolation work together rather than as separate, optional layers.
We practice least-data collection — we ask for and store only the information needed to run the product, and we do not collect employee data we have no use for.
Where your data is hosted
Application & data
Supabase (managed PostgreSQL database, authentication, file storage, and edge functions), running on Amazon Web Services in a United States region.
Website & content delivery
Netlify provides static hosting, a global CDN, and TLS certificates for the pages and published content we serve.
Document rendering (turning content into PDFs) runs on a dedicated Railway worker. It receives document content only for the duration of a render and does not serve as a system of record.
Our sub-processors
We use a small, deliberate set of established sub-processors to operate the product. Each one handles a specific function:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, storage, and edge functions — the core application data layer. |
| Amazon Web Services | Underlying cloud infrastructure that Supabase runs on (US region). |
| Netlify | Static website hosting, global CDN, and TLS. |
| Railway | PDF / document rendering worker. |
| OpenAI | AI text generation for content-drafting features. |
| Anthropic | AI text generation for content-drafting features. |
| Twilio | SMS notifications and alerts. |
The full, current list — including the specific data each provider processes and its location — is maintained on our sub-processors page. We do not sell customer data, and we do not permit our AI providers to train their models on your content.
Compliance posture
We want to be precise here, because security pages too often imply certifications that don't exist. Here is the honest picture:
- In place Our product is built on infrastructure that is independently SOC 2 Type II audited. Supabase, Amazon Web Services, and Netlify each maintain their own SOC 2 Type II attestations, and our data lives within those environments.
- In progress Custom Ai Apps LLC's SOC 2 certification is in progress and on our roadmap. We will update this page as that status advances.
- Available A HIPAA path with a signed Business Associate Agreement (BAA) is available for healthcare customers who need it. If you operate under HIPAA, contact us before onboarding so we can configure your account accordingly.
Reliability & backups
- Daily automated backups of the application database.
- Point-in-time recovery (PITR) on the database, which lets us restore to a specific moment rather than only to the most recent nightly snapshot — narrowing potential data loss to minutes in a recovery scenario.
- Stored files inherit the durability of Amazon Web Services storage, and the static website can be redeployed from source at any time.
Security contact
If you have a security question, a concern, or wish to report a vulnerability, contact us at security@zipplee.io. We read and respond to every report.