Skip to content
Security

How Zubby protects your data

The security controls built into the product. Zubby AI does not currently publish a SOC 2 report, offer a contractual uptime SLA on self-serve plans, or run multi-region failover; contact us if your review needs more detail.

  1. Shopper or merchantBrowser, widget, or dashboard
  2. Edge checksSpoofed store headers stripped, widget key verified, rate limits
  3. Zubby appStore-scoped reads, role checks, encrypted secrets
  4. AI modelQuestion plus the store context needed to answer
Store platforms send data back through signed webhooks, checked before any processing. Which AI provider handles a request is listed on the sub-processors page.

Product controls reviewed against local source on 21 October 2026. This is a description of implemented controls, not an independent security audit. Ask the team for your hosting provider, processing region and security questionnaire details before making a residency or compliance decision.

Controls in the product

Store-level access checks

Dashboard pages and server actions verify store membership and role permissions. Widget and public API credentials resolve their store on the server and reject stores that are not active.

Secret protection

Connected-store and integration secrets are encrypted with AES-256-GCM. Store and integration secrets are bound to their context, so an encrypted value cannot be moved to another store or field.

Authentication

Passwords use Node.js scrypt with random salts and timing-safe checks. Older sessions end after a password or security change. TOTP and single-use backup codes are available.

Webhook validation

Shopify, Freemius, and legacy Stripe webhook signatures are verified before processing. Deliveries are stored for idempotent background handling, and payloads are removed on the retention schedule.

Input and network boundaries

API payloads are schema-validated, outbound requests to user-supplied URLs use safe-URL checks where wired, and email headers with control characters or injected fields are rejected.

Hosting

Zubby runs in a single hosting region, without multi-region failover.

Responsible disclosure

Report a suspected vulnerability to hello@zubbyai.com with the affected component and steps to reproduce.

  • Do not access other customers' data.
  • Do not disrupt the service.
  • Do not publish details before a fix is coordinated.