Security and your data
You are putting your customers, your staff records and your figures into Hubber. This page says plainly how they are looked after. It lists what we do, and makes no claims beyond that.
Your company's data is kept separate
Every record in Hubber belongs to one company. Each request checks which company the signed-in person belongs to and returns only that company's records. One company cannot see another's customers, jobs, staff or figures.
Passwords are hashed
Passwords are stored as bcrypt hashes, not as readable text. Nobody at Hubber can read your password. When a password is changed or reset, that person's other signed-in sessions are ended, so a lost phone or shared computer stops working.
Permissions are enforced on the server
Each role has its own level of access to each part of Hubber. Those rules are checked on the server for every request. Hiding a button is not what keeps a porter out of the payroll. See permissions and reports.
Files are private
Staff documents, job photos, contracts and receipts are held in private storage. When someone with the right access opens a file, Hubber issues a link that works for a few minutes and then expires.
Hubber never sees card numbers
Your customers pay on Mollie's checkout page, so card details go to Mollie and not to Hubber. The money settles to your own Mollie account. Hubber never holds your customers' money. Direct Debits are run by GoCardless, so Hubber does not hold your customers' bank account numbers either. Your own subscription is billed by Stripe in the same way.
The bank connection is read-only
If you connect your business bank account, Hubber can read the transactions and nothing else. It cannot make a payment, set up a transfer or move money. Only the company owner can connect or disconnect the bank, and the bank asks you to confirm the access again from time to time. See bank feed.
Where it runs
Hubber is hosted on Vercel, with a Supabase Postgres database. The application runs in London. All traffic is sent over HTTPS, and browsers are told to use HTTPS only.
Support access is logged
Hubber support staff can sign in to a company's account to help fix a problem. Each time they do, a log entry records who did it, which account and when.
Privacy and your rights
Hubber handles personal data under UK GDPR. The privacy policy sets out what is held and why, the terms set out the agreement between us, and the data deletion page explains how to have data removed.
If you have a security question this page does not answer, ask us.
Run your next job in Hubber
Start a 14-day free trial. Set up your services, send a quote and book a job today.
A card is needed to start the trial. You are not charged until day 15, and you can cancel before then.