Trust & Safety

Who can access customer data

• Workspace access: PatchyHub uses owner, administrator, and member roles. Application access is scoped to a user's workspace membership.
• PatchyHub administration: Micheal Pacitto is currently the only person with administrative access to production customer data. Customer content is accessed only for customer-requested support, service operation, security investigation, legal compliance, or other work the customer authorizes.
• Public sharing: Shared documentation and map links are capability links. Anyone who possesses an active link can view the content exposed by that link without signing in. Shared-documentation links can be replaced or deactivated.
• Service providers: The providers listed below receive only the information needed to perform their identified function.

PatchyHub does not sell or rent customer data.

Confirmed technical controls

• Encrypted transport and infrastructure: PatchyHub is served over HTTPS. Supabase states that customer data on its hosted platform is encrypted at rest with AES-256 and in transit with TLS.
• Workspace isolation: PatchyHub uses Supabase Row Level Security and workspace-scoped access rules. At the August 20, 2026 production review, Row Level Security was enabled on every table in the production public database schema.
• Integration credentials: Stored HighLevel integration tokens are encrypted at the application layer with AES-256 using a key held in Supabase Vault. Token encryption, decryption, storage, and retrieval functions are callable only by server-side database roles, not normal browser roles.
• Server-side secrets: Provider credentials and privileged database credentials are held in server-side environment or secret storage and are not included in the browser application.
• Payment-card handling: Checkout is hosted by Stripe. PatchyHub stores Stripe customer, subscription, and invoice references, but does not receive or store full payment-card numbers.
• Credential removal during imports: PatchyHub's import sanitization removes passwords, tokens, authorization material, private keys, and credential-bearing URLs from imported asset content before that content is retained for normal product use.

AI data handling

PatchyHub sends AI requests directly to the Anthropic API. Each request includes the user prompt and the workspace content needed for the requested analysis. PatchyHub stores chats and generated results when needed to provide conversation history and product features.

Anthropic states that commercial API inputs and outputs are not used to train its models by default. Anthropic also states that standard API inputs and outputs are automatically deleted from its backend within 30 days, except for its documented safety, legal, or contractual exceptions. Read Anthropic's training policy and retention policy.

Infrastructure and data location

PatchyHub's primary database, authentication service, storage, and edge functions run on Supabase. The primary database is hosted in the AWS us-east-1 region in the United States. The public application and its serverless routes are hosted on Vercel. Provider infrastructure may process requests or logs in other locations described in each provider's documentation.

Service providers and integrations

Certifications and independent testing

PatchyHub itself is not SOC 2 certified, is not ISO 27001 certified, and has not completed an independent penetration test. Supabase, Vercel, and Stripe publish certifications and security information for their own services. Those provider certifications do not make PatchyHub certified.

• Supabase security and compliance
• Vercel security and compliance
• Stripe security

Deletion and incident notification

Eligible sole-member workspaces can be deleted in PatchyHub after an active subscription is cancelled. Account and data-deletion requests can be sent to privacy@patchyhub.com. Limited billing, security, abuse-prevention, or legal records may be retained when still needed for those purposes.

If PatchyHub confirms a breach affecting customer data, affected customers will be notified without unreasonable delay.

Questions or security reports

Contact privacy@patchyhub.com. Do not include passwords, access tokens, private keys, or other live credentials in the report. See the Privacy Policy and Terms of Service for the full public terms.