What protects your workspace today, stated plainly. Anything not yet in place is marked.
The app runs on Lovable Cloud: server code on a global edge network, with the database, sign-in and file storage hosted by Supabase in Canada (AWS ca-central-1).
Not in place yet: a choice of data region (for example Singapore or Sydney). All workspaces are stored in Canada today.
All traffic uses HTTPS (TLS). The database and file storage are encrypted at rest by the hosting platform.
Tokens for connected Instagram, Facebook, TikTok and YouTube accounts are also encrypted in our own code (AES-256-GCM). They are never sent to the browser.
Sign-up is invitation-only. Every customer table uses row-level security, so people can only read workspaces they belong to. Roles (Owner, Strategist, Analyst, Client viewer) limit what each person can change. Only Owners can manage share links, resume paused collection and change session settings.
Organisation owners can set an idle sign-out time and sign out of their other sessions. Password-protected share links lock after repeated wrong attempts.
Sign-ins, role changes, invites, share links, exports, account connections, memory edits, budgets and pause/resume are recorded with time, person, IP address and browser. Owners can see this in Settings → Team & sign-in → Activity.
Not in place yet: multi-factor authentication enforcement, and SSO beyond Google.
Connecting your own accounts is optional and read-only. Klypps asks only for insight scopes and never posts, edits or messages on your behalf. Disconnecting deletes stored insights and the token straight away. We also handle platform deletion requests: Meta data deletion and TikTok deauthorisation. Competitor and creator data always comes from public sources only.
Database backups are handled by the hosting platform.
Not in place yet: a backup schedule we have confirmed ourselves, point-in-time recovery, and a tested restore drill with published recovery targets.
Automated checks run hourly and daily (collection errors, stale data, budget limits and a daily end-to-end check). Alerts go to workspace owners in the app. If a breach affects your data, we will notify you within 48 hours of becoming aware of it, so you can meet Singapore PDPA and Australian Notifiable Data Breaches deadlines.
Not in place yet: email alert delivery (waiting on a sender domain) and an independent penetration test.
Please report suspected vulnerabilities through the contact form on our home page and put "Security" in your message. Please don't access other customers' data or disrupt the service. We will acknowledge reports within 3 business days.
Not in place yet: a dedicated security email address and bug bounty.