Security

Where your data lives

• Database and files: at Supabase, in Stockholm (Sweden).
• Application and background jobs: at Vercel, in Stockholm (Sweden).
• Email: through Resend, sent from Ireland.
• AI analyses: through the Vercel AI Gateway to Anthropic, OpenAI, Google and Perplexity. These providers may process data outside the EU; the safeguards in our privacy policy apply.

Encryption

All traffic between you and Recommendable is encrypted over HTTPS. Supabase and Vercel also encrypt the data they store.

Who can access it

• Recommendable is invite-only. You sign in with Google, Microsoft or an email address with a password.
• Passwords have at least twelve characters and are checked against known leaked passwords.
• All customer data in the database is isolated per organisation, with access rules on every table. An account only sees the brands and data of its own organisation.
• Only the two founders have access to the production systems, both with two-factor authentication.

AI processing

The AI models only receive what an analysis needs: mostly public web pages and the brand profile you provide. This runs through paid business API accounts. The Vercel AI Gateway does not keep prompts and responses after a call has finished.

Backups

The database is backed up every day, and we can restore up to seven days back. Uploaded files are not part of those backups.

Retention and deletion

We keep your data and uploads for as long as your account and your brand exist. When you delete a file yourself, we remove it from storage straight away.

To have your account or organisation deleted, email info@recommendable.co. We delete everything within seven days and confirm it by email. The daily database backups still hold it for at most seven days after that.

How we test

We test security ourselves, at least every quarter and before every major release. Among other things we check the isolation between organisations, account permissions and access to database functions and background jobs. What we find, we fix.

Our partners' certifications

Recommendable itself does not hold a SOC 2 or ISO 27001 certification. Our infrastructure runs at companies that do: Supabase has a SOC 2 Type 2 attestation, Vercel a SOC 2 Type 2 attestation and an ISO 27001 certification.

When something goes wrong

If we discover a data breach that affects your data, we tell you within 48 hours. Where the law requires it, we also report it to the Dutch Data Protection Authority.

Reporting a vulnerability

If you think you have found a security problem, email info@recommendable.co. We respond within two working days. Only test with your own account and do not publish anything before it is fixed. Our contact details are also in security.txt.

Vendors

The companies that process data for us are listed in our privacy policy.