Updated 4 November 2026
This page describes in general terms how we protect what we build and host for our clients.
Hosting
- Our servers and databases are in Finland, and our backups in Germany, Estonia and Sweden. The European companies on the sub-processors page provide all of this, except the backup copy in Sweden, which is on our own equipment.
- Every website and the app are served over encrypted connections only.
Jurisdiction
Our servers, databases and backups are subject to EU law and the law of the country each is in. Nodebrush AB is a Swedish company and is bound by Swedish law. If an authority outside the EU asks us for data, we hand over no more than EU or Swedish law requires of us.
AI Tools
- The only thing AI does in our services is read a document such as an invoice or a receipt, and only when a person with access to your account asks for it. That person decides whether it happens once or on a schedule. The document is sent to Anthropic, which may use it for that reading alone and never to train AI models.
- The AI tools we use in our work come from Anthropic, and we send them only what a task needs. Anthropic may use it only for that task and never to train AI models.
Access
- A client's people see only their own projects in the app, and each person has a role that decides what they can do. Nobody at a client has administrator rights over the platform.
- Strong sign-in methods are supported, and sign-ins are protected against repeated guessing.
- Passwords and the keys used to sign in to the app are stored only in a form that cannot be read back, and keys to connected accounts are stored encrypted.
- Our own accounts for running the services use two-step sign-in wherever the provider offers it.
- An AI assistant connected to the app has no more access than the person who connected it, and a person decides what goes live. The assistant cannot read the messages sent through a client's website, or see who has booked a time, signed up for a newsletter, sent in an image or become a member there.
Client Separation
- Each client's data is kept apart, and the app is built so that a request made for one client does not return another client's data.
- Pages being edited or previewed are isolated from the app's sign-in, so code on a page does not reach anybody's account.
Changes
- Nothing changes on a live website until a person publishes it, and saved changes can be undone.
- Only scripts we have approved run on a website.
- Security updates are installed promptly, and the software the app is built on is checked regularly for known vulnerabilities.
Monitoring
- The availability of every website is monitored, and we are alerted when something stops.
Backups
- Everything we host is backed up at least once a day.
- Backups are encrypted.
Incidents
If something affects a client's data or service, we limit the damage first, which can mean taking a site offline or removing access at once. A client whose personal data is affected is told without undue delay after we become aware of it, with what is known at that point, and is given the cause and what was done as soon as we know them.
Reporting
If you find a security problem in a website we host or in the app, write to support@nodebrush.com.
Clients
The Technical and Organizational Measures document describes each of these measures in detail, and the Data Processing Agreement refers to it. Both are in the Legal folder of your project in the app, where everyone on the project can read them. A change to the Technical and Organizational Measures does not lower the overall protection of your data, and you are told of it as the Services Agreement sets out.
