Security
Introduction to security
In this section, we'll dive into the topic of ensuring your app's safety and protecting your users' data. When it comes to security, Bubble's primary goal is to provide a solid foundation that follows industry best practices. Bubble as a platform doesn't reinvent the wheel; instead, we rely on proven methodologies to deliver tools that let you set up applications with security that's comparable to the world's major software providers.
As we discuss Bubble's security measures, it's important to remember that our platform's flexibility can be a double-edged sword. Bubble empowers you with the tools and options to create versatile applications; however, this also means that you bear the responsibility of using these tools correctly to guarantee a secure environment.
Your app's security is ultimately in your hands, and it's crucial to understand and implement best practices while building your app to protect your users and their data.
Throughout this chapter, we'll explore the various aspects of Bubble's security and provide insights into how you can make the most of our platform's features to create a safe and secure application.
Our shared security responsibility
Bubble operates within a "Platform-as-a-Service" (PaaS) architecture, where we serve as a facilitator for developing, deploying, and hosting web applications. We maintain a close collaboration with Amazon Web Services (AWS).
This structure means that there is a shared security responsibility between Bubble, AWS, and you as a user of the Bubble platform.
Bubble commits to providing and maintaining the tools that our users need to keep their data and processes safe. This includes Bubble account security, data encryption at rest and in transit, user authentication, rigorous application-level safeguards, consistent service uptime, pen testing, logging, backups, and DDoS protection. Bubble is compliant with the SOC 2 Type II standard for security, and we have implemented measures designed to meet the standards of applicable data privacy laws, including the General Data Protection Regulation in the EU and the UK.
Amazon AWS oversees aspects such as the physical infrastructure, hardware, network, and the integrity of the server environment.
Bubble users are responsible for understanding and following our terms and acceptable use policy, maintaining secure account access, supplying precise and up-to-date information to Bubble, understanding and using Bubble’s settings and tools correctly, and reporting security issues to Bubble in a timely manner.
What security means
When discussing app security, it's common to focus on malicious intent, such as hacking. However, when planning your security measures, it's essential to recognize that hackers represent just one aspect of potential security risks. There are several other equally important factors to consider:
Database leaks
Database leaks in this context means inadvertently leaking data to users who shouldn't have access to it. This is handled by setting proper on all private data types.
Revealing data in the app code
Although Bubble is a no-code platform, the final app consists of HTML, CSS, JSON and Javascript that Bubble generates for you. Since these files are downloaded to the user's device, a tech-savvy user can look at them. If you have inadvertently placed sensitive data such as API keys in certain parts of your app, the user may be able to extract them.
We have a closer look at this potential vulnerability in our article on Page security.
Unauthorized account access
Another potential vulnerability includes users gaining access to other users’ accounts. When planning your app to avoid this issue, you should make sure you have a secure sign-up and login process. You can also consider enforcing a password policy and two-factor authentication.
Improper app security settings
Bubble offers multiple settings on an app level, such as encrypting data in by use of , protecting your with a username and password and controlling the access level of .
We strongly recommend reviewing these settings thoroughly.
We explore this subject in more detail in our articles on App security and Securing your Bubble account.
API calls
API calls can also open up for potential vulnerabilities if set up incorrectly. We go over this in detail in our article on API security.
Continue reading
Last updated