How does the free plan work?

Sign up and start using PrivaBase immediately. No credit card required. The Starter plan includes 1 compliance framework, 5 checks per month, policy generator, website scanner, and access to the compliance feed.

What compliance frameworks do you support?

We support 132 frameworks including GDPR, CCPA/CPRA, HIPAA, SOC 2 Type II, SOC 1, ISO 27001, PCI DSS, NIST, DORA, NIS2, 18 US state privacy laws, and international frameworks. You can also build custom frameworks.

How many integrations do you support?

Over 214 integrations across 12 categories including cloud infrastructure (AWS, GCP, Azure), identity (Okta, Google Workspace), DevOps (GitHub, GitLab), MDM (Jamf, Intune, Kandji), HR (Gusto, Rippling, BambooHR), and more.

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Evidence is stored in Supabase Storage with framework-level access controls. We never share your data with third parties.

Do you offer annual billing?

Yes, save 20% with annual billing on all paid plans.

Security at PrivaBase

We build privacy compliance tools — so security isn't just a feature, it's our foundation. Here's how we protect your data.

Encryption

TLS 1.3 for all data in transit (HTTPS everywhere)
AES-256-GCM encryption for sensitive fields at rest
SHA-256 hashed tokens (password reset, API keys, sessions)
Database-level encryption via Supabase (AWS encryption at rest)

Infrastructure

Hosted on Vercel (SOC 2 Type II certified)
Database on Supabase (SOC 2 Type II, HIPAA compliant)
US-East region (Virginia) for primary infrastructure
Automatic failover and redundancy
No customer data stored on local machines or development environments

Authentication & Access

JWT-based authentication with 30-minute access tokens
Refresh token rotation with 30-day expiry
Email verification required on signup
Rate limiting on all endpoints (100/min general, 10/min auth)
API key authentication with scoped permissions
CORS restricted to privabase.com subdomains only

Application Security

Input validation and sanitization on all endpoints
UUID parameter validation middleware
SQL injection prevention via parameterized queries
XSS protection through React's built-in escaping
CSRF protection on all state-changing operations
Security headers (Strict-Transport-Security, X-Content-Type-Options, etc.)

Compliance

GDPR compliant — cookie consent, DSAR support, data minimization
CCPA compliant — opt-out support, data access/deletion requests
HIPAA considerations for healthcare customers (BAA available)
SOC 2 Type II controls implemented (self-assessed)
Regular security audits and vulnerability assessments

Monitoring & Incident Response

Continuous monitoring of all API endpoints
Automated alerting on anomalous activity
Audit logging for all data access and administrative actions
Incident response plan with 24-hour notification commitment
Regular backup testing and disaster recovery procedures

Data Handling

Data minimization — we only collect what's necessary
No selling of customer data to third parties, ever
Customer data isolation — each account's data is logically separated
Data retention policies aligned with applicable regulations
Right to deletion supported — data is permanently purged on request

Report a Vulnerability

Found a security issue? We appreciate responsible disclosure. Please email us with details and we'll respond within 24 hours.

security@privabase.com

Last security audit: February 12, 2026 · Next scheduled audit: May 2026

Questions? Contact us ·Submit a data request

Application Security

Input validation and sanitization on all endpoints

UUID parameter validation middleware

SQL injection prevention via parameterized queries

XSS protection through React's built-in escaping

CSRF protection on all state-changing operations

Security headers (Strict-Transport-Security, X-Content-Type-Options, etc.)

Data Handling

Data minimization — we only collect what's necessary

No selling of customer data to third parties, ever

Customer data isolation — each account's data is logically separated

Data retention policies aligned with applicable regulations

Right to deletion supported — data is permanently purged on request