Bubble User Account Security

Questions
1

Hey everyone!

I’ve worked with Bubble for a while now and I really enjoy how users accounts are set up.

I feel I should know this by now, but what are the technical specifics behind Bubble when it comes to creating users and their passwords, etc?

I have come across 2 potential clients with different security requirements:

  1. A US based health app where HIPAA is essential (Health Insurance Portability and Accountability Act)

  2. A job description that highlights the following requirements:

  • Auth via NextAuth.js or Clerk

Basically, what could I respond to the potential client with that would put their mind at easy that their data is secure.

Furthermore, are there additional settings or plugins I could use to double down on the default user account security?

Cheers

2

Hey,
First, Bubble is NOT HIPPA Compliant so it’s not the right platform for the Heathcare industry. For such a potential customer, you might want to consider (Supabase OR Xano as a backend + WeWeb as a front end). Whatever your choice is, please make sure of the right plan that meet HIPAA requirements, otherwise you can go for Supabase since it’s open source and self-host it.
Second, I didn’t try myself Auth via NextAuth.js but I think it could be possible. I can’t give you a solid answer.

Finally, When it comes to security, the “Privacy Rules” settings are very important and should be configured correctly to avoid any potential data leaks. You can check out “Flusk” tool (recently acquired by Bubble) that checks for any vulnerabilities in your app.

Hope this helps !

3

Thank you Ahmed, that’s great feedback, much appreciated.

I had also heard that Bubble wasn’t HIPAA compliant, so I think I was just wondering what else Bubble doesn’t meet the standards of.

I will definitely be checking out Flusk as well, thank you!

4

Well I believe you might want to check out these 2 links from Bubble documentation about Bubble security & compliance. It is mentioned here By Bubble that they do not recommend using the platform for apps that require HIPAA compliance.

1 Like
5

But as I understand it, this concerns the backend, if we use Xano or Supabase we will have HIPAA compliance even if the frontend is in Bubble.

6

No, you won’t

1 Like
7

Unfortunately no, because Bubble logs will have the patient information so we can’t even use Bubble in this case even as as frontend only

1 Like
8

To be HIPPA compliant you can only use Bubble for any aspect (front end or back end or both) if you tokenize patient info. It’s doable but not simple and depending on hse case might not be practical

1 Like