Trust & Security
Your data security is our top priority
At thimblely, we understand that your business data is sensitive and valuable. We've built our platform with security at its core to ensure your information is always protected.
Security Features
End-to-End Encryption
All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.3 encryption.
Secure Infrastructure
Our infrastructure is hosted on enterprise-grade cloud providers with SOC 2 Type II certification and multiple redundancy layers.
Access Controls
Role-based access controls ensure team members only see what they need. Multi-factor authentication adds an extra layer of security.
Regular Backups
Your data is automatically backed up multiple times daily with point-in-time recovery capabilities.
Data Integrity
We implement checksums and validation to ensure your data remains accurate and uncorrupted.
Privacy by Design
Privacy considerations are built into every feature from the ground up, not added as an afterthought.
Compliance & Certifications
GDPR Compliant
We comply with EU General Data Protection Regulation requirements.
PIPEDA Compliant
We adhere to Canadian privacy law requirements.
SOC 2 Type II
Our infrastructure providers maintain SOC 2 certification.
PCI DSS
Payment processing meets PCI Data Security Standards.
How We Handle Your Data
What data we collect
- Account information (name, email, password hash)
- Business data (clients, orders, inventory)
- Usage analytics (anonymized)
- Support communications
How we protect your data
- Encryption at rest and in transit
- Regular security audits
- Employee security training
- Incident response procedures
Your data rights
- Access your data anytime
- Export your data in standard formats
- Request data deletion
- Control sharing preferences
Who Processes Your Data
thimblely runs on a small number of providers. These are all of them, what each one handles, and where it sits.
| Provider | What it does | Location |
|---|---|---|
| Supabase | Database, authentication and file storage. Your workspace, clients, orders and uploads live here. | United States |
| Mistral AI | The AI behind client-book and receipt scanning, the WhatsApp assistant, voice-note transcription, invoice and portfolio drafting, expense categorisation, financial summaries and content moderation. | France |
| Meta (WhatsApp Business Platform) | Delivers and receives WhatsApp messages between you and the thimblely assistant. | United States and Ireland |
| Resend | Sends transactional and product email on our behalf. | United States |
| Vercel | Hosts thimblely.ca and the signed-in web app. | Global edge network |
AI features send only the content a feature needs, only when you use it. See the Artificial Intelligence section of our Privacy Policy for what that covers.
Our Security Commitment
We continuously invest in security measures and regularly review our practices to ensure we meet the highest standards. If you discover a security vulnerability, please report it to our security team.