Security
Your backend hosts your data and your users' data. Here is, concretely, how it is protected.
Per-project isolation
- Each project gets its own PostgreSQL database, isolated from the others: no tables shared between customers.
- Each database has its own dedicated PostgreSQL role, limited to its own scope.
- Projects run in separate containers.
- PostgreSQL Row Level Security (RLS) protects data at the core of the database, per user.
Encryption
- All traffic is encrypted in transit (TLS), with automatically managed certificates.
- Secrets (database credentials, API keys, certificates stored in the vault) are encrypted at rest with AES-256-GCM.
- Account passwords are hashed (scrypt/bcrypt), never stored or transmitted in plain text.
Backups
- Automated daily backup of each database, independently from the others.
- 30-day retention.
- You can export your data at any time (standard PostgreSQL).
- Latest real restore drill: 55 tables (12757 rows) restored and verified in 1 s, on 2026-07-10.
Hardened infrastructure
- Servers in Europe, behind Cloudflare (DDoS protection, strict TLS to origin).
- Server access by SSH key only: root login and passwords disabled.
- Active firewall (only web and SSH ports are open) and automatic banning of intrusion attempts (fail2ban).
- Rate limiting on APIs to contain abuse.
Accounts & access
- Two-factor authentication (TOTP 2FA) available on Clicbase accounts.
- Sensitive programmatic operations (API keys) are limited by scopes, and can require human approval (optional).
- No credit card data is stored by Clicbase: payment goes through a secure provider.
Reversibility: your data is yours
- Your databases are standard PostgreSQL: no proprietary format.
- You can export all your data and leave at any time; we provide the export.
- Migration works both ways: in (from Supabase) and out.
🕵️ Report a vulnerability
Found a flaw? Write to [email protected] (or via /.well-known/security.txt). We respond quickly and gladly credit responsible disclosures.