Download or delete it yourself
Enter the email you used with us at thewebsuite.co/my-data and we send a one time link. From there you download a copy of what we hold about you, or delete it, without waiting on us.
Security
What happens to your data here.
Seven protections, each one something you can check. Nothing on this page is a badge we have not earned.
Book a free callHow your data is handled
Each of these names what we do, not what we intend. Every one is live today.
Encrypted on the way
Every page and every request to this site and to the systems we host travels over HTTPS.
Locked to the right people
The database itself decides who may see each record, through row level security, not only the screen. A record a person may not see is never sent to their browser.
A history that shows tampering
Important actions are written to an audit log where every entry is sealed to the one before it. Changing or removing an old entry breaks the chain, so it shows.
Backed up every day
Our database is backed up every day, and each backup is kept for 7 days.
Never sold, never used to train AI
Our Data Processing Addendum says so in writing. Our AI assistant drafts replies, and a person approves each one before it is sent.
Stored in the US
Everything is kept in the US. TheWebSuite's own records (this website, orders and client portals) are in our database in Northern California. A client system with logins or ordering gets its own separate database in Northern Virginia, never shared with another business.
Certifications: the plain answer
We hold no SOC 2 report, no ISO 27001 certificate and no independent penetration test. You will not find a badge on this page, and you will not find a “coming soon” where one should be.
What we can do instead is show you each protection above working, on a call, and put it in writing in our Data Processing Addendum.
The questions your IT person will ask
What counts as our data?
Everything you send us and everything entered into a system we build or host for you: your records, files, messages and content. It is always yours, whatever else the license covers.
Who at TheWebSuite can see it?
Only people working for TheWebSuite who need access to do the work, and each of them is bound to keep it confidential. We do not yet use time limited access grants that you approve; access is limited by role.
Where is it stored?
In the US. There are two kinds of database: TheWebSuite's own (this website, orders and client portals) in Northern California, and a separate one for each client system with logins or ordering, in Northern Virginia. The site and our server code run on Vercel. Every outside service that can receive personal information is listed on our Services we use page.
How long do you keep it?
Only as long as it is needed. Records we must keep for accounting, tax and our agreement with you, such as invoices and signed agreements, are kept for up to seven years after a project. Section 10 of our Privacy Policy has the details.
What happens to our data if we leave?
You choose: we hand you an export in a standard format, or we delete it. Unless you ask otherwise, you get the export and the 14 day handover, and then we delete your data from the live systems.
Do you hold SOC 2 or ISO 27001?
No, and no other certification or independent penetration test either. The section above says what we can show you instead.
How do we report a security problem?
Email support@thewebsuite.co. Every report gets an answer.