fideria
Log inBook a demo
Trust

Security & Trust

Last updated October 8, 2026. A factual overview of how Fideria protects customer data and meets European compliance requirements.

Document
Data Processing Agreement
GDPR Article 28 template · PDF, 3 pages
Download DPA →
Data storage
Stockholm, Sweden
AI processing
United States
Encryption
TLS 1.2+ · AES-256
Breach notice
GDPR Art. 33
What's true today

These controls are in production now. They are not roadmap items or aspirational statements.

Access control
  • SAML 2.0 SSO
  • Role-based access control
  • MFA for all production staff
  • Admin-gated database writes
Encryption & data location
  • TLS 1.2+ in transit
  • AES-256 at rest
  • Stored in Stockholm · AI prompts processed in the US
  • Daily encrypted backups
AI governance & data handling
  • Row-Level Security per organization
  • Lovable states: Fideria user data is not used for model training
  • Customer records deleted from the live database
  • Backup retention unpublished; no selective backup deletion
  • Article 17 & 20 rights in-product
Audit logging
  • Append-only per-organization log
  • Sign-in, roles, SSO, exports
  • Severity filtering
  • CSV export
Application security
  • Zod validation on every endpoint
  • Signed webhooks
  • Dependency & static analysis
  • RLS policy audits
Incident response & EU frameworks
  • Breach reporting to customers
  • On-call rotation
  • EU AI Act alignment
  • NIS2 alignment
Controls in detail
01AI governance & data handlingCustomer records are isolated and can be deleted from the live database. Backup erasure limitations apply. Lovable states that data submitted by Fideria users is not used to train its models, on any plan.
  • Per-organization isolation enforced by Row-Level Security.
  • Lovable states that data submitted by Fideria users is not used to train its models, on any plan. This is the platform's stated position, not a contractual assurance under Fideria's current plan.
  • Fideria deletes the customer's records from the live database. Backup copies age out according to a retention period that Lovable does not publish. Selective deletion of a customer's records from backups is not possible.
  • Lovable's platform-level deletion operates per project or account: data first becomes inaccessible, then is permanently removed, including from backups, after a retention period Lovable does not publish. This is not the same as Fideria deleting one customer's records in a shared live database.
02Infrastructure & encryptionStored in Stockholm, encrypted in transit and at rest, with daily backups. AI prompts are processed in the United States.
  • Storage: the database and its backups are stored in Stockholm, Sweden. Processing: prompt content, including text extracted from invoice emails, is sent to Google and OpenAI endpoints and processed in the United States.
  • Fideria holds no ISO 27001 or SOC 2 certification of its own. Certifications that hosting providers publish are theirs and do not cover Fideria.
  • TLS 1.2+ in transit, AES-256 at rest, secrets in managed vault.
  • Daily encrypted backups with point-in-time recovery.
03Access controlSSO, role-based access, MFA for staff and least-privilege engineering.
  • SAML 2.0 SSO for enterprise; RBAC separated from profile data.
  • MFA enforced for all Fideria staff with production access.
  • Engineering access is time-bound and reviewed quarterly.
  • Org settings, roles, SSO and alerts restricted to admins at the database layer.
04Audit loggingAppend-only audit log for every security-relevant action, exportable as CSV.
  • Per-organization, append-only audit log.
  • Covers sign-in, role changes, SSO config, data export and deletion.
  • Admins can search, filter by severity and export as CSV.
05Application securityValidated inputs, signed webhooks, dependency scanning and continuous policy audits.
  • Zod validation on every server endpoint; bearer tokens validated server-side.
  • Webhook signatures verified with constant-time comparison.
  • Dependency scanning, static analysis and database linter on every release.
  • RLS policies and SECURITY DEFINER grants audited 13 June 2026, no critical findings open.
06Incident response & complianceOn-call rotation, breach reporting to customers under GDPR, and alignment with EU AI Act and NIS2.
  • On-call rotation with defined severity levels and response times.
  • Personal-data breaches reported to the customer without undue delay, so the customer can meet its 72-hour duty under GDPR Art. 33.
  • Post-incident reviews shared with affected customers.
  • Article 20 export and Article 17 deletion available in-product.
  • EU AI Act and NIS2 technical and organizational measures are in place.
What the platform does not publish

Status as of October 1, 2026. Lovable does not publish the following information for this application:

  • How long prompts or outputs are retained at the AI gateway or model providers.
  • The terms governing access to customer-connected mailboxes, including whether content is retained in transit.
  • Which provider delivers a given application's email, its delivery region, or the retention period for delivery logs.
Security is a posture, not a checkbox. We publish what's in place, what's aligned, and what's planned, and we don't pretend otherwise.
Fideria security posture
SE
Database stored in Stockholm
US
AI prompts processed in the US
72h
GDPR breach window (Art. 33)
Live
Deletion in the live database; backup limits apply
Are you SOC 2, ISO 27001 or ISO 42001 certified?

Not yet. The controls above are implemented today. A SOC 2 Type II audit window, ISO 27001 certification and ISO 42001 AI management system alignment are all targeted for 2027. Ask us for the current state of specific controls if that's relevant to your review.

Sub-processors
A reviewed list of the providers behind hosting, authentication, email and AI, with data paths and the contract status of each. Fideria notifies customers without undue delay after it has itself been notified of a sub-processor addition or replacement. The customer's objection period starts with Fideria's notification and is never shorter than the objection period available to Fideria from its upstream provider. For upstream changes, notice is given as soon as Fideria knows, not a fixed number of days in advance. Customers may object on reasonable data-protection grounds. If an objection cannot be resolved, the customer may terminate the affected part of the Service in accordance with the master agreement.
View list →
Responsible disclosure
Security issues to security@fideria.ai. Acknowledged within two business days. No legal action for good-faith research.
Report an issue →
Documentation on request
DPA, sub-processor list, CAIQ-Lite, independent penetration test scheduled before first production deployment, and architecture overview available to enterprise customers.
Request docs →