Security at QubeHub

Last updated: September 26, 2026

Developers put their most sensitive commercial data into QubeHub: buyers, agents, prices and unsold stock. This page explains how that data is protected. The contractual commitments are in our Terms of Service and Data Processing Addendum.

Your data is isolated

• One database per customer. Each customer’s data lives in its own database instance. There is no shared cross-customer database, and your data is never pooled with another developer’s or with any agency network.
• Hosted in the EU. The platform and its customer databases run on DigitalOcean infrastructure in Germany.
• Encrypted in transit and at rest.
• Backed up at infrastructure level for disaster recovery.

Access is tight and logged

• Platform users sign in with a one-time password. Agents use a magic link sent by email, SMS or WhatsApp. One-time passwords expire after 90 seconds.
• Customer databases accept connections only from whitelisted IP addresses. They are not reachable from the open internet.
• Multi-factor authentication protects the hosting, cloud and source-code accounts through which customer environments are administered.
• Administrative access to customer data is logged, and the logs are kept for at least 12 months.
• Role-based permissions run through the Admin, Agent and Client APIs. Customers decide who in their team and agent network sees what.

People

Everyone on our team who can access customer data is bound by written confidentiality obligations and works on a need-to-know basis. Where a customer requires it, team members sign personal undertakings that the customer can enforce directly.

AI, without training on your data

• We never use customer data to train or improve AI models, and our AI providers (OpenAI, Anthropic) are contractually barred from doing so.
• Data sent to a model for an answer is kept by the provider for no more than 30 days, for service delivery and abuse monitoring only, or not at all where zero-data-retention applies to our account.
• Our public-facing AI assistants, such as AI pre-qualification on WhatsApp or Telegram, see only the conversation in front of them. They have no access to your database, leads or contacts.
• Brochures and documents you add to a knowledge base are stored for retrieval until you remove them.

If something goes wrong

We notify affected customers without undue delay, and in any event within 48 hours of becoming aware of a personal data breach, with a full report within 72 hours. Security contact: [email protected].

You can always leave with your data

Self-service export is available at any time: JSON or CSV, Excel for leads, and original files for documents and media. After a subscription ends, export stays open for 90 days whatever the reason, including if QubeHub itself stops providing the service.

Sub-processors

The full list, with locations, is at qubehub.ai/subprocessors.

Reviews

Our CTO runs regular internal security reviews of the platform. Customers can request our security documentation, or audit us once a year under the DPA.