freehub· Trust & Security
Built EU-first. Provable, not promised.
freehub is a B2B reporting platform for agencies in the German market. This page states exactly how data is protected — and where we are on the compliance roadmap. Questions or reports: serhat@freelopers.com.
01 · Security measures
EU data location
Database in Frankfurt (Supabase · AWS eu-central-1); compute pinned to Frankfurt (Vercel fra1). EU-first is a standing rule for every new component.
Tenant isolation, tested
Admin / partner / customer scopes are enforced in the data-access layer and page guards — and pinned by an automated integration suite (cross-tenant reads resolve to nothing, verified on every push).
Least-visibility access
Customer guests get a curated read-only lens; within a team, hours are member-private (team-wide detail only for named team leads + admin). The full matrix is public in-app (/guide).
Encryption & credentials
TLS in transit. Connector tokens AES-256-GCM at rest; passwords salted-hashed (scrypt); API tokens stored only as SHA-256 hashes and auto-expire after 90 days.
Abuse controls
Rate limits on login, password change, OAuth and the MCP endpoint; per-person AI budgets; sessions are signed server-side and expire.
Auditability
An append-only event log records changes (including admin view-as sessions); AI calls are usage-logged per task.
AI, on demand only
AI providers (Anthropic, OpenAI) receive only content a user explicitly submits, solely to produce the requested output — no model training on API data, nothing in the background.
Crawl protection
Only this public surface is indexable; every session page, share link and API response carries noindex headers.
02 · Subprocessors
| Provider | Purpose | Region | Transfer basis |
|---|---|---|---|
| Vercel Inc. | Hosting & compute (pinned to Frankfurt, fra1) | EU compute / US company | EU-US DPF + SCCs |
| Supabase (on AWS) | PostgreSQL database | Frankfurt (eu-central-1) | DPA — data stays in the EU |
| Anthropic | AI: routing, summaries, grounded Q&A | USA | EU-US DPF / SCCs · no training on API data |
| OpenAI | AI: semantic-search embeddings | USA | EU-US DPF / SCCs · no training on API data |
| Optional, per-user OAuth: read-only Drive/Gmail pulls | EU/USA | User consent + Google DPA | |
| Atlassian (Trello) · Asana | Optional connector pulls (per-agency token) | USA/EU | Provider DPAs |
| Brevo | Ops digest e-mail (when enabled) | EU (France) | EU processor |
This table is the authoritative list referenced by the privacy policy and our data-processing agreements. New providers are added here before they ship.
03 · Compliance status
- Live GDPR compliance pack: this page, privacy policy, Impressum, Art. 28 DPA template, data-subject export/erasure tooling, breach runbook, security.txt, security headers, tenant-isolation test suite.
- In progress German translations · CSP · signed provider-DPA inventory.
- Planned Trusted Cloud Label + CSA STAR Level 1 self-assessment · independent penetration test. Certifications (ISO 27001) follow commercial scale.
04 · Responsible disclosure
Found a vulnerability? Please e-mail serhat@freelopers.com (see security.txt) with steps to reproduce. We acknowledge within 72 hours, keep you informed, and never pursue good-faith research legally.