Security
How Kable protects your data: hosting in the European Union, encryption, access control, tenant isolation, and audit trail.
Kable manages sensitive data: signatories, mandates, banking authorizations. Security and data protection are designed in from day one, and the entire platform is hosted in the European Union. This page describes the concrete measures we put in place.
1. Hosting and data location
Account data and business data are hosted in the European Union, on Supabase infrastructure. All application services rely on this European infrastructure, which ensures your data stays located within the EU. Our hosting providers, Supabase and Vercel, run on ISO 27001 and SOC 2 certified infrastructure.
2. Encryption
Your data is encrypted at every stage:
- In transit: all communications between your browser and our servers are encrypted over TLS.
- At rest: data stored in the database is encrypted.
3. Access control
Access to data is strictly controlled:
- Hardened authentication at sign-in.
- Role- and entity-based permissions: each user sees only the entities they are explicitly authorized on.
- Least privilege: the rights to create, approve, and sign are granted separately, entity by entity.
4. Data isolation
Kable is a multi-tenant platform. Each customer's data is strictly isolated at the logical level: no query can reach another customer's data. This isolation is enforced at every level of database access.
5. Audit trail
Sensitive actions are recorded in an immutable audit log. Every change to a mandate or an authorization is timestamped and traceable, making it possible to reconstruct the full history of decisions.
6. Sub-processors
We rely on the following sub-processors to provide the service. Each is bound by a data processing agreement (DPA).
| Sub-processor | Purpose |
|---|---|
| Supabase | Authentication and database |
| Vercel | Website hosting |
| Railway | Backend hosting |
| Yousign | Electronic signature |
| Resend | Transactional email delivery |
| PostHog | Audience analytics |
| Cal.com | Meeting booking |
The DPA for each of these sub-processors is available on request. We never sell or rent your data to third parties.
7. International transfers
Account and business data is hosted in the European Union. Some technical sub-processors are based outside the EU, notably in the United States. Transfers are governed by the mechanisms provided for under the GDPR: European Commission's Standard Contractual Clauses, or the Data Privacy Framework where applicable.
8. Reversibility
Your data belongs to you. On request and at the end of your contract, we return all of your data and the documents generated, in standard formats.
9. Contact
For any question about security, email jonathan.perbet@kableapp.com.