How Buyerbase handles security
What we hold, where it runs, how to tell us when something is wrong, and the things we deliberately do not claim. Written to be checked, not to reassure.
Where buyer data lives
Every subsystem that holds or processes buyer data, with the region we have verified for it. A region appears here only when it has been confirmed in the provider's own dashboard or API.
| What it holds | Provider | Verified region |
|---|---|---|
| Buyer records, notes and pipeline | Supabase | Ireland (EU) |
| Uploaded buyer documents | Supabase Storage | Ireland (EU) |
| The app itself | Vercel | Dublin (EU) |
| Error reports | Sentry | Germany (EU) |
| Product analytics | PostHog | European Union |
Not confirmed yet
These subsystems are in use, or come into use with a feature an agency switches on, and their region is not confirmed. We list them rather than assume they sit in the EU.
- Invite and notification email: Resend
- Identity verification: iDIN (Betaalvereniging Nederland)
- WhatsApp reminders and agency updates: Meta (WhatsApp Business Platform)
- AI requests, routing: Vercel (AI Gateway)
- AI answers and summaries (GPT models): OpenAI
- AI answers and summaries (Claude models): Google Cloud (Vertex AI)
- AI answers and summaries (Claude models, second route): Amazon Web Services (Bedrock)
Retention is set per agency and is under legal review against Wwft duties, so no period is stated here as a fixed number. Your data processing agreement carries the current position.
Report a vulnerability
If you have found a problem, tell us before you tell anyone else and we will work it through with you. Reports are read by a person, not a queue.
security@buyerbase.app is the mailbox. The machine-readable version is at /.well-known/security.txt
What you can expect
- We acknowledge your report within 72 hours.
- We tell you within 10 days whether it is a finding and what we intend to do about it.
In scope
- The Buyerbase website
- The agency app, including agency subdomains and custom domains
- The buyer portal
- The public API and the MCP endpoints
Please do not
- Run denial of service, load or stress tests against any host.
- Phish, call or otherwise social engineer our staff, our agencies or their buyers.
- Attempt physical access to any office or device.
- Test third party services we use rather than operate. Report those to the provider.
- Send scanner output for missing headers or version banners with no demonstrated impact.
- Send bulk email, spam or automated signups through our forms.
Safe harbour
- We will not pursue legal action for research that follows this policy.
- We treat a good faith report as help, and we will say so if we disagree about severity.
- Use only accounts and data you own. Stop as soon as you can prove the issue, and never download, alter or keep someone else's data.
- We credit you by name on this page once a fix ships, unless you would rather stay anonymous.
External penetration test
No external penetration test has been carried out yet. We would rather say that than let silence imply one exists. Booking the first test is on the plan before general availability, and its summary lands on this page when the report exists.
What we do not claim
- Buyerbase holds no ISO 27001, SOC 2 or comparable certification. Anyone telling you otherwise is wrong.
- We do not claim Buyerbase staff cannot reach a file. Access is restricted by policy, needs a stated reason, and is recorded in an access log the agency can export.
- We do not claim a region we have not verified. The list above is the whole of it.