Hello fellow Bubblers 
A friend and I are working on a project where we will be storing a bunch of personal data from our users.
That could include birth date, ID card, social security number, administrative documents, logins to other web services and more.
We are based in Europe.
We love 
Bubble but are wondering if it is a good fit from a security standpoint.
And if so, what measures we should take to protect these info.
So, is Bubble okay for storing sensitive info? 
I’m also using this post to sum up what I’ve read here and there on the forum, for other Bubblers to use.
We know that:
- HTTPS / SSL encryption is available on paid plans, to secure the info between the user’s browser and the database
- The database is encrypted at rest, on AWS RDS, which has “state-of-the-art security”. In addition, users’ passwords for our Bubble apps are stored separately, salted and encrypted, by Bubble (this is why you don’t see them in your database, only the user’s email)
- Privacy roles is the layer to take care of to secure the data
- Bubble is not yet PCI Compliant. (But we’re not storing credit card information. We’ll probably use Stripe)
- Bubble is not yet HIPAA Compliant. (But we’re not storing medical information)
- Bubble is on it’s way to become GDPR compliant, which also impacts their relation to their sub-processors. Also see Data Processing Agreement
Interesting threads on the subject:
Thanks to them! 
- Explaining to clients our app abides by standard security/compliance practices
- Bubble for entreprise software: privacy issues?
- Website Security
- Advice needed from the more experience developers and business users
Specific questions:
- I read and agree that “storing passwords in plain text is bad practice” and that we could use some “salting and hashing”. How do we achieve that? And why not apply that to all the data?
- If storing personal data in Bubble is an overall bad idea, how should we proceed? Using a third party (which? how?)? Using another platform than Bubble? Eating a taco
and relaxing? - Could one build a password manager (such as KeePass, LastPass and co) on Bubble? If not, why not?
- Is there a way for us not to see the data stored in our database (meaning only the user can access it and if they lose their ‘key’, then it’s lost)? I’m thinking something like this. But since Bubble employees can see the data, I guess not.
Other security thoughts for Bubblers:
- Have workflows to re-direct unauthenticated users
- Use a strong admin password and encourage your users to use strong passwords and store them properly
- Have the data backed up
- Keep your bubble app up-to-date (updates)
- Every action is logged (see your Logs) which enables audit if needed
- Look into Bubble’s uptime guarantee (in case that’s a concern)
- Have a contingency plan in case your team dies during your basejump team-building week-end. Just as Bubble do
Idea:
I would suggest Bubble to provide us with a page with a list of these security features and a text we could use in our apps to provide security info to our users.
Heads up to @emmanuel & @josh 
Thanks if you read it to here! Any comments and thoughts more than welcome!