Where your information goes
AI Easy Apps uses several services with different responsibilities. Your records, uploaded files and downloaded exports do not necessarily live in the same place.
- Supabase hosts the PostgreSQL database used for account profiles, membership and sharing configuration, app definitions, application records, form responses and operational state such as approval and workflow information.
- Vercel hosts the web application and server-side request processing. Requests, uploads and responses can pass through this hosting environment; it is not just a place for public website images.
- Connected Google Drive, Microsoft OneDrive or SharePoint can hold attachments and exported files. The database holds file references and metadata such as name, provider, owner and size. App branding images can also be embedded in app configuration.
- Configured spreadsheet or Microsoft List destinations hold additional copies of the data sent to them. Downloaded exports are also copies on the recipient's device.
Access to accounts, apps and records
Sign-in establishes identity. Account and workspace membership, creator seats, app roles and record-access rules then determine the actions available. A billing role does not automatically give someone access to every business record.
The application uses server-side permission checks and PostgreSQL row-level security for user-scoped record access. Hiding a field or filtering a view is presentation, not a substitute for those access rules.
Platform administration and authorised service operations are separate from ordinary app-user access. Row-level security does not mean that hosting operators or every privileged service identity are technically unable to access data.
- Grant the minimum app access each person needs and review it when people leave.
- Protect the Google or Microsoft identity used to sign in, including multi-factor authentication where available through that identity provider.
- Test sharing with a separate user rather than assuming the owner's view matches everyone else's.
Files and public form links
Form attachments are uploaded through the application into the form owner's connected storage. In-app access to stored attachments checks sign-in, app and record access, and the stored file reference before retrieving the file. Provider permissions and external sharing links are separate controls.
A published public-form link allows people to submit without signing in. It does not grant access to the response table or make uploaded files public. Treat the submission link as something recipients can forward. Close the form or replace its link when collection should stop.
Removing a member, closing a form or deleting an app should not be treated as proof that every exported file, external List item or previously downloaded copy has also been deleted.
Encryption and connection protection
The hosted application uses HTTPS. Its database connection code requires TLS certificate verification. The application also encrypts newly stored Google and Microsoft refresh tokens; these tokens let authorised features use connected storage without asking for a password on every request.
Supabase documents encryption at rest with AES-256 and TLS in transit. Vercel also documents encryption controls for its infrastructure. These provider statements describe their respective services; they are not a claim of end-to-end encryption between individual app users. Authorised application services must be able to process data to provide the features.
Supabase and SOC 2
Supabase states that it is SOC 2 Type 2 compliant and undergoes annual assessment. It also publishes ISO 27001 certification information. SOC 2 Type 2 reports assess the operation of controls over a period of time; they are not a guarantee that an application can never suffer a security incident.
For procurement or a formal security review, use Supabase's current report and certificate, including their scope and reporting period. Report access can depend on the provider's plan or request process.
Vercel and SOC 2
Vercel publishes a SOC 2 Type 2 attestation covering Security, Confidentiality and Availability, and ISO 27001:2022 certification. Its official compliance page and Trust Center provide current information and access instructions.
Vercel secures its hosting infrastructure; AI Easy Apps remains responsible for its application code, configuration, permissions and handling of customer information.
What provider certifications do not mean
Using Supabase and Vercel does not give AI Easy Apps its own SOC 2 attestation or ISO 27001 certification. This guide makes no claim that AI Easy Apps has independently obtained either.
Provider certifications also do not automatically establish that your particular use meets GDPR, POPIA, HIPAA or another legal or contractual requirement. The data you collect, access settings, processing purposes, provider agreements and operating practices all matter. Confirm the requirements for your intended use with the account owner and platform team.
Hosting regions and international processing
The current application deployment configuration targets Dublin, Ireland for Vercel application functions. Supabase hosts the primary database in the region selected for its project; confirm the current production database region with the platform team before relying on a contractual residency requirement.
A function or database region is not a promise that every copy and processing step stays in that country. Content delivery, provider operations, logs, connected Google or Microsoft services, AI processing and user downloads may involve other locations. Supabase explicitly distinguishes regional database hosting from other processing outside that region.
For a residency review, ask for the current production database and compute regions, backup arrangements, connected-storage tenant locations, AI services and applicable data-processing agreements together.
How AI assistance processes information
AI requests send your prompt and relevant feature context to the configured AI service. Depending on the feature, that context can include conversation history, app structure, field names and examples or data you put in the conversation. The implementation supports Google Gemini and an optional xAI provider path; availability depends on deployment configuration.
Do not assume prompts stay only in Supabase or that all AI processing occurs in the database region. Use non-sensitive examples where possible, and include only information you are authorised to share. This guide does not promise zero provider retention or exclusion from model training; confirm the applicable provider configuration and contractual terms before sharing sensitive information.
Exports, deletion and retention
Export the records you need using the supported CSV, Excel or snapshot features, and check the result. An export is not necessarily a complete backup of app configuration, permissions, attachments and linked destinations.
Application records, external files, delivered List items, logs and provider backups have different lifecycles. Deleting a record from a view does not establish immediate erasure from every system or backup. This guide does not promise a universal retention period, backup schedule or recovery time.
For account closure, personal-data requests, retention requirements or an incident, use Help to contact the platform team. Explain the account, app and data category involved without sending passwords, access tokens or unnecessary record contents. Confirm the scope of any deletion and retention arrangement before relying on it.
Review date and further questions
Provider statements and product behaviour were reviewed on 5 November 2026. Follow the official source links for current report availability and scope. This guide explains the product architecture and practical controls; it does not replace a privacy notice, contractual data-processing agreement or a security assessment for your organisation.