Hello,
Emmanuel here, cofounder.
While I can’t tell precisely how others convince their clients things are secure, I can give you a few hints when talking to your clients.
Generally speaking, Bubble is hosted on AWS West Region (Oregon, US) which maintains a state-of-the-art security infrastructure. We encrypt all traffic to bubble.is over https, and encourage and support our clients to use encryption on their own domains. All user passwords are stored salted + encrypted in our database; other user data is encrypted at rest (we’re on AWS RDS).
You can add a SSL connection to your own domain under the Professional Plan. If you’re on bubbleapps.io domain, SSL is included.
In terms of making sure non authorized users see some data, you have to set up some privacy rules that are enforced server side. that’s an advanced feature but necessary if you want data to be secure.
Lastly, for enterprise clients, we can move them on a dedicated hosting plan, where we do the same as above, but only for them and their data. Isolation can have some value for larger clients.