How we protect your work and your clients' data

Where your data lives

Ayebridge runs on established infrastructure providers. The application is hosted on Vercel in the United States. The database is managed PostgreSQL on Neon, also in the United States. Uploaded files are kept in a private Cloudflare R2 bucket. The full list of providers, what each one does and where it processes data is on the subprocessors page.

Encryption

All traffic to ayebridge.com, client portals and file links uses TLS (HTTPS). Data is encrypted at rest by our providers: Neon encrypts database storage, and Cloudflare encrypts objects stored in R2.

Private deliverables

Deliverables are shared only with the people you invite, never on a public page. Specifically:

• Files are kept in a private storage bucket that cannot be browsed or listed from the internet.
• When someone opens or previews a file, Ayebridge first checks that they are allowed to see it, then issues a signed link that expires a few minutes later.
• Only your team and the invited contacts of the client a project belongs to can get those links.
• Executable and script file types, such as .exe, .msi and .sh, are blocked at upload by default, on both the file extension and the reported file type.
• Each plan has a storage allowance and a maximum upload size.

Tenant isolation

Each workspace is a separate tenant. Every query for workspace data in our data layer is scoped to the workspace of the signed-in person, and IDs that come from the browser are checked against that workspace before anything is read or changed.

Client portals are scoped twice: to the workspace and to the single client the contact belongs to. A client contact can only see their own portal. Automated tests attempt cross-workspace and cross-client access and check that every attempt is refused.

Accounts and access controls

• Team members have a role in each workspace (Owner, Admin or Member), and sensitive actions are limited by role.
• Team members can turn on two-factor authentication with an authenticator app (TOTP), with backup codes for recovery.
• Email addresses are verified before a team member can invite clients or teammates.
• Client contacts sign in with single-use links sent to their email, which expire after 15 minutes. They do not need a password.
• Sign-in, sign-up, password reset, two-factor, upload, invitation, contact and report forms are rate limited.
• Session cookies are secure and HTTP-only. Team members can review their sessions and sign out other devices, and a password reset signs out other sessions.

Audit events and approval records

Ayebridge records audit events for sensitive actions, including role changes, invitations, deletions, data exports, approval decisions and billing changes. On Agency Plus and above, workspace owners and admins can review these events in the activity log.

Approval decisions are stored as permanent records with the name and email of the person who decided, the version and the time. They cannot be edited after the fact.

Backups and your own copy

The database is covered by the backups of our database provider, Neon.

Owners and admins can also export the workspace at any time as a ZIP archive with your files and JSON and CSV copies of your projects, approvals and comments. See how to export your data.

Payments

Card payments for subscriptions are handled by Stripe, a PCI DSS Level 1 service provider. Card details are entered on Stripe's hosted checkout page and customer portal, so Ayebridge never receives or stores full card numbers.

Ayebridge doesn't process payments between you and your clients. Quotes and invoices in Ayebridge are documents only.

Privacy and data processing

When you store your clients' information in Ayebridge, we process it on your behalf. Our Data Processing Addendum describes the security measures, subprocessors and breach notification commitments that apply. Our Privacy Policy explains how we handle account and website data.

Reporting a vulnerability

If you believe you have found a security issue in Ayebridge, please email security@ayebridge.com with a description, the steps to reproduce it and any relevant URLs. Our contact details are also published in /.well-known/security.txt.

We ask that you:

• Only test against your own account and workspace, never against other customers' data.
• Avoid actions that could degrade the service, such as load testing or high-volume automated scanning.
• Give us reasonable time to investigate and fix the issue before sharing details publicly.

We will acknowledge your report, keep you informed while we investigate and let you know when it is resolved. We do not currently run a paid bug bounty program.