Introducing SOC 2 and Bubble for Enterprise

[georgecollier]

@fabian.keim

An independent auditor verified that our information security practices, policies, procedures, and operations meet the rigorous SOC 2 standard for security.

On this front, has there been any change on the fact that some Bubble employees can get unrestricted access to an app’s data (reference:

@josh

Can the Bubble team view our app’s data?

Yes. We view user data in order to respond to help requests and diagnose system issues. We have internal policies against accessing data except as necessary to address a specific customer need. We do background checks before hiring employees who will have access to customer data, and we take the responsibility of avoiding data misuse seriously. We plan to strengthen controls around this as we grow: for instance, we may in the future switch to an opt-in protocol where most members of the team can’t access data unless the app owner specifically consents. For now, we are a pretty small organization that works closely together, so we feel comfortable that we have a good sense of what everyone on the team is doing with user data.

That was a long while ago and Josh said it was going to change but I’ve never seen evidence of an opt-in protocol. Just seems like a big vulnerability if a disgruntled Bubble employee could access any app’s data without authorisation from the owner

If anyone can find an update on this let me know…