Bubble is hosted on AWS which maintains a state-of-the-art security infrastructure. We encrypt all traffic to bubble.is over https, and encourage and support our clients to use encryption on their own domains. All user passwords are stored salted + encrypted in our database; other user data is not encrypted at rest, but we plan to change this in the next two months as part of a migration from a NoSQL database (elasticsearch) to a SQL database (postgres).