Summary
| Area | Status |
|---|---|
| TLS 1.3 in transit | Yes |
| AES-256 at rest | Yes (Supabase-managed) |
| SOC 2 Type II-backed infrastructure | Yes - via Supabase + Vercel |
| GDPR-ready | Yes - DSR flows + DPA on request |
| Multi-tenant isolation (Row-Level Security) | Yes - on every table |
| AI features (Claude / OpenAI) | Run on Klimb's platform keys by default (metered as AI credits). Optional BYOK keys stay in your browser, never stored server-side. |
| Zero third-party marketing trackers | Yes |
| HIPAA compliance | No. Klimb is not designed for Protected Health Information. |
| End-to-end encrypted data (keys held only by user) | No. Super-admins can read your audit data by design - classical server-encrypted model. |
Encryption
All traffic between your browser and Klimb uses TLS 1.3 (HTTPS). Databases are encrypted at rest with AES-256 by Supabase. Klimb's own AI provider keys (Anthropic / OpenAI) and Google service-account keys are stored in Vercel's encrypted secret store and are never exposed to the browser. If you use the optional BYOK path, your own Anthropic / OpenAI key is stored only in your browser and forwarded through a single server request to the provider - never written to our disk, logs, or database.
Tenant isolation
Klimb is multi-tenant on a single Supabase instance. Every table that contains project data has a project_id column and a Row-Level Security policy that calls has_project_access(project_id) . This means:
- Members can only read rows for projects they are explicit members of.
- Agency admins can read across projects they manage.
- The database rejects any query that doesn't pass the access predicate - it's enforced at the engine level, not in application code.
Authentication
- Email + password or Google OAuth, both handled by Supabase Auth.
- Password requirements: 8+ characters, mixed case, number, special character. Validated live in the signup flow.
- OTP email verification required for email signup - prevents account-takeover by unverified emails.
- Session tokens are JWT-based with automatic refresh. Sessions persist in HTTP-only cookies (Secure, SameSite=Lax).
Data you control
- Export: From Profile → Export my data you can download a full JSON copy of your account + projects.
- Delete: From Profile → Delete my account you can permanently delete your user and cascade-delete everything you own. Soft-delete window: 30 days, then hard-deleted from backups.
- Disconnect integrations: Remove a Google service-account or Apify token any time from Integrations; data pulled via that integration stops immediately.
Sub-processors
- Supabase - hosted Postgres + auth. SOC 2 Type II.
- Vercel - Next.js hosting + edge network. SOC 2 Type II.
- Apify - SERP, backlinks, content-gap, PAA scrapers. Per-request only.
- Google - GA4, Search Console, PageSpeed Insights. Read-only, scoped to the property you connect.
- Anthropic / OpenAI - process the prompts + content you submit to AI features. Used by default through Klimb's own accounts (metered as AI credits); an optional BYOK key routes to your own account instead.
A Data Processing Agreement (DPA) is available on request. Email sakshi@goodlives.in.
What we log
- Server logs: request method, path, status code, latency, anonymized IP. Retained 30 days.
- Audit activity: which user changed what (task edits, project edits). Retained with the project.
- We do not log request bodies, AI provider keys (Klimb's or your BYOK keys), or service-account JSON contents.
Incident response
In the event of a personal-data breach, we notify affected users within 72 hours per GDPR Article 33 + India's DPDP Act. Critical security vulnerabilities can be reported to sakshi@goodlives.in - we respond within 24 hours.
What we explicitly don't claim
We'd rather be under-sold than over-sold. Things Klimb is not:
- Not HIPAA-compliant. Klimb is an SEO tool, not a health-data platform. We haven't signed Business Associate Agreements. Don't store PHI here.
- Not end-to-end encrypted. Server can read data - super-admins do so for audits by design. Traffic and storage are encrypted, but this isn't Signal-style E2E.
- Not hidden from AI providers. AI features send your prompts and the content you submit to Anthropic and/or OpenAI to generate output - by default on Klimb's own accounts, or your own account if you add a BYOK key. We don't sell or train on your data, but it does leave Klimb to be processed by those providers under their terms.
- Not FedRAMP / ISO 27001 certified (yet). Inheriting SOC 2 from Supabase + Vercel is our current posture.
Questions?
sakshi@goodlives.in - we reply within one business day.