Security

1. Hosting in the EU

PraismaHub runs on servers in the European Union (Hetzner, Germany). Your workspace data stays in the EU; the few service providers that may process limited data elsewhere are listed in our Privacy Policy.

2. Every workspace is isolated

• Each workspace has its own separate database. One workspace cannot read or change another's data.
• Live updates in the app (notifications, chat, editors) run over private channels that are checked against your workspace and your permissions.

3. Encryption and network

• All traffic uses HTTPS (TLS) with HSTS, so browsers never fall back to an unencrypted connection.
• Cloudflare sits in front of the platform for DDoS and bot protection.
• Passwords are stored only as strong one-way hashes, never in plain text.

4. Access control

• Team members get roles and permissions; each person only sees and changes what their role allows.
• Removing a member signs them out everywhere at once: their sign-in, connected AI tools and reset links are revoked.
• You can sign in with Google instead of a password.

5. AI and connected tools

• The AI agent works only inside your workspace and with the permissions of the person using it. Changes to live data, such as publishing or deleting, ask for confirmation first.
• Connecting PraismaHub to Claude or ChatGPT uses OAuth: the tool gets at most the access of the user who connected it, limited to the scopes they approved, and the workspace owner can switch connectors off.
• We do not use your workspace content to train AI models.

6. Uploads and code

• Uploads are checked against an allow-list of file types, and SVG files are cleaned of scripts before they are stored.
• Custom code components and code projects run in an isolated frame and can only load an approved list of libraries — never scripts from other sites.

7. Payments

Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Card details go straight to Stripe; PraismaHub never sees or stores full card numbers.

8. Deleting your data

When a workspace owner deletes a workspace, it is closed at once and its data is deleted. We check that the deletion is complete before we confirm it by email. See our Privacy Policy for retention periods.

9. Report a vulnerability

Found a security issue? Email info@praisma.nl with the subject "Security" and the steps to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data or disrupt the service while testing. We reply within two business days.