Agencies run confidential work through Cuebor — briefs, contracts, government and enterprise client material. This page describes, plainly, how that data is protected. Everything written here is checkable in the product.
All traffic is encrypted in transit with TLS. Data — the database and every uploaded file — is encrypted at rest with AES-256.
Integration credentials (Google, Slack) are additionally encrypted at the application layer with AES-256-GCM before they are stored, so a database read alone never yields a usable token.
Every query in the product is scoped to your agency workspace. There is no cross-tenant read path: your clients, documents, messages, and files are invisible to any other workspace.
Each client portal is a private, unguessable link that you can revoke or rotate at any time — rotation kills the old link and every verified device instantly.
For sensitive clients you can additionally require email verification: the portal will not render until the visitor confirms a one-time code sent to the client's email, once per device. Links can also carry a hard expiry date.
Files live in private storage buckets. There are no permanent download URLs anywhere in the system: every open mints a signed link that expires in minutes.
Every document open and download is recorded — which side opened it, and when. That access trail is visible to the agency on each document, so “who has seen this file” has a factual answer.
The assistant reads client context to draft follow-ups, extract facts, and watch account health. That processing is controllable per client: switching a client to confidential mode stops all background AI processing for them — nothing about that client is sent to a model unprompted.
AI requests are processed via Google's Gemini API. Your content is used to serve your requests, not to train foundation models. AI outputs are stored inside your workspace like any other record.
Meaningful events — portal views, document opens, share-link creation, access-setting changes — are written to each client's timeline. Security-relevant changes name what changed and who changed it.
Supabase (AWS) — database, authentication, file storage. Vercel — application hosting. Google Gemini API — AI processing. Resend — transactional email. Google Workspace and Slack are contacted only if your workspace connects them.
Your data belongs to your agency. Deleting a client removes their records and files from the workspace, and full workspace deletion is available on request — write to us and it is actioned, not queued indefinitely.
Security questions, disclosure reports, or a client questionnaire you need answered — write to [email protected]. A human replies.