Security

Where your data is stored

• The database, sign-in and file storage run on Supabase in the eu-central-2 region (Zurich, Switzerland).
• The application and its server functions are hosted on Vercel in the Frankfurt region (fra1, Germany). Static pages are served from Vercel’s global network.

Who can see what

• Row-level security (RLS) is enabled on every table in the database, so each company only sees its own rows.
• Access inside a company is role-based (for example office, project manager, site manager, installer and subcontractor). Installers only see their own work.
• The AI agent and MCP connections act with the signed-in user’s rights — they cannot see more than the user’s role allows.
• MCP connections use per-user tokens with rate limits, and documents are served through time-limited signed links.

Encryption in transit

• All traffic between your browser or the mobile app and our servers is encrypted with HTTPS (TLS).

Use of AI

• SimpleBot uses third-party AI models. Most model calls go through OpenRouter, which routes them to model providers such as Anthropic (Claude) and OpenAI. Google Gemini, Mistral (OCR), ElevenLabs (speech) and Jina AI (reading web pages) are used for specific tasks.
• In OpenRouter calls we set the routing so that requests only go to providers that do not store or reuse request content.
• SimpleSoft does not use your data to train AI models. Companies can also connect their own Anthropic or OpenAI key, in which case calls are made on their own account.

Report a security issue

If you find a vulnerability or suspect misuse, email us and we will respond on the next working day: simplesoft.fi@gmail.com