Security & Trust
Procurement-grade disclosure, written without marketing fluff
Everything on this page comes from our internal Trust Centre register. A control is only listed once it is backed by verified evidence.
Certifications
We show the honest status of each programme. We do not claim certifications we do not hold.
Not started
Cyber Essentials
Not started
ISO/IEC 27001
Not started
ISO/IEC 42001
Not started
SOC 2 Type II
Evidence-backed controls
Our controls are being evidenced. Detailed control descriptions are available to prospective customers on request while publication completes.
Sub-processors
Providers this platform actually uses, from our subprocessor register.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare | Edge hosting and request routing | Request metadata, IP addresses | Global edge network |
| Optional "Sign in with Google" | Name, email and profile identifier of users who choose Google sign-in | To be confirmed | |
| Lovable | Application platform and transactional email delivery | Account emails, names, message content of transactional emails | To be confirmed |
| Supabase | Database, authentication and file storage (via Lovable Cloud) | Account data, workspace records, telemetry, audit entries, attachments | To be confirmed |
Request a security questionnaire
SIG-Lite, CAIQ or custom, answered under NDA.