Data encrypted at rest
Your subscription data is stored in Supabase (PostgreSQL), which encrypts data at rest using AES-256. Data in transit is encrypted via HTTPS/TLS.
No bank or card access
HubStaq does not connect to your bank account, credit card, or any payment processor. We never ask for financial credentials of any kind.
No payment data stored
We do not store credit card numbers, bank account numbers, or any payment details. Billing for paid plans is handled entirely by Stripe — we never see your card data.
We don't sell your data
Your subscription data belongs to you. We don't sell it, share it with third parties, or use it for advertising. We use it to provide the service, full stop.
What data we store
When you use HubStaq, we store the following:
Account data: Your name and email address, used to create and authenticate your account. Passwords are hashed (bcrypt) — we cannot read your password.
Subscription data: The tool names, costs, billing cycles, renewal dates, owners, teams, and notes you enter manually. This is the core data you add yourself.
Session data: Authentication tokens stored in your browser's localStorage to keep you logged in between visits. These expire and can be cleared by signing out.
We do not collect usage analytics beyond basic server logs (IP address, request timestamps) needed to operate the service.
How authentication works
HubStaq uses JWT (JSON Web Token) authentication. When you sign in, your browser receives a token that is stored in localStorage and sent with each API request. Tokens are verified server-side on every request. You can invalidate your session at any time by signing out.
Passwords are never stored in plain text. We use bcrypt hashing, which means even if our database were compromised, your password could not be read directly.
Infrastructure and hosting
The HubStaq backend runs on Railway (Node.js/Express). Your data is stored in Supabase (managed PostgreSQL). The frontend is hosted on Namecheap. All communication between these services uses HTTPS.
We use Supabase's managed infrastructure, which provides automatic backups, row-level security, and encryption at rest.
Being honest about where we are: HubStaq is an early-stage product. We're not yet SOC 2 certified. We don't have a formal security review process or a dedicated security team. What we do have: encrypted data storage, hashed passwords, HTTPS everywhere, and no access to your financial infrastructure. If security compliance requirements are important for your organisation, we'd encourage you to contact us and discuss your specific needs.
Reporting a security issue
If you find a security vulnerability in HubStaq, please email us at hello@hubstaq.com with a description of the issue. We'll respond within 48 hours and work to address it quickly. We appreciate responsible disclosure and will credit researchers who report valid issues.
Questions
If you have any questions about our security practices, email hello@hubstaq.com. We'll give you a straight answer.