Security

• Everything travels encrypted. The website, dashboard, and every connection to our servers use TLS, and we tell browsers to never fall back to plain HTTP (HSTS).
• Your data lives in a hosted Postgres database run by Supabase on Amazon Web Services in the United States, encrypted at rest by Supabase. Each business’s records are separated by database-enforced access rules, and the application connects with a role that cannot bypass them.
• The application runs on Render in the United States.
• Card numbers never touch Pombi. Subscription payments go through Stripe’s hosted Checkout, and card changes go through Stripe’s hosted billing portal. We see only the last four digits, the brand, and the payment status.
• Passwords are handled by Supabase Auth, which stores them as bcrypt hashes. Pombi never sees or stores your password.
• Two-step verification is available with an authenticator app. Turn it on under Settings, then Security.
• Repeated failed sign-ins lock the account for a cooling-off period, and we email you when a lockout or a sign-in from a new device happens.
• API keys are stored as hashes. The key itself is shown once when you create it; afterward we hold only a hash, so a copy of our database cannot be used to call your account.
• Webhooks are signed. Every webhook Pombi sends carries a signature your server can check, so nobody can forge a Pombi event.

Your data is backed up on more than one rail, with more than one provider:

• Supabase keeps a managed daily backup of the whole database for 7 days.
• Our own job dumps every table and every uploaded file (logos, photos, menus) nightly, and again every six hours from GitHub Actions, kept for 14 days off the database provider.

The restore path has been tested, not assumed: a script restores the newest dump into a throwaway database and checks that every business came back, and we have run it. A daily status check reports the age of every backup rail, so a backup job that quietly stops running shows up the next morning.

Conversation words have a fixed life. Call transcripts, text messages, web chats, and synced email bodies are automatically deleted 365 days after the conversation. What remains is the metadata: when it happened, which channel, and how it ended. This cannot be switched off.

Business records and customer records (your profile, hours, services, customer names and numbers, bookings, orders) are kept for the life of your account.

Connected-account credentials (Google, QuickBooks, Square, Stripe) are deleted the moment you disconnect, which also revokes our access at the provider. Google tokens are additionally encrypted at rest with AES-256-GCM.

Deleting your account is a button in the dashboard under Settings; it removes the business and everything under it. Anyone, including your customers, can ask for their data to be removed at pombi.app/data-deletion, which also shows where a request stands. The full retention schedule is in our Privacy Policy.

Pombi runs on a small number of named providers. Each one gets only what its job needs, under terms that limit its use to serving you:

• Supabase: the database and sign-in system. Holds your business records, conversations, and account credentials.
• Render: runs the Pombi application. Handles every request and response, including the data in them.
• Stripe: subscription billing and, where you enable it, your customers’ payments. Gets names, email addresses, and card details entered on Stripe’s own pages.
• Twilio: phone calls and text messages. Gets phone numbers, call audio in transit, and message text.
• Resend: sends and receives email on our behalf. Gets the addresses, subjects, and bodies of email that goes through Pombi.
• Anthropic: the AI that reads a conversation and drafts a reply. Gets the conversation text and the business knowledge you have taught the assistant. Not used to train their models.
• Deepgram and Cartesia: turn caller speech into text and the assistant’s text back into speech during a call. Get the live audio of the call.
• Google: only when you connect it. Calendar gets bookings, Business Profile gets listing and review access you grant, and Places is used to look up public business listings.
• Square and QuickBooks: only when you connect them. Get the orders and invoices you choose to sync.
• Microsoft Clarity: website usage analytics, only when we have switched it on. It is off unless a project id is configured, and it never sees conversation content.

• Texting consent is recorded. Before a customer gets a text, we keep a record of how and when they agreed, so a STOP or a question later can be answered from the record.
• The assistant says it is an assistant. On the first contact in a conversation, by call or by text, it says so.
• No call audio is recorded. What we keep from a call is a text transcript, and a caller who asks not to be recorded has even the transcript dropped.

We have not completed a SOC 2 or ISO 27001 audit. The controls on this page are real and we can show you them, but no outside auditor has certified them, and we will not say otherwise until one has.

We do not sign HIPAA Business Associate Agreements, because our own providers do not yet extend that chain to us. If you run a dental office, a med spa, or any practice that handles protected health information, please do not send patient health details through Pombi. Booking a time and taking a name and number is fine; diagnoses, treatment notes, and insurance details are not.

When either of these changes, this page will say so, and the “Last updated” date at the top will move.

If you have found a weakness in Pombi, or you think your account has been accessed by someone else, email security@pombi.app. It reaches the founders directly. Please include:

• What you saw, and the page or feature where you saw it
• The steps to make it happen again, if you know them
• The date and time, and the account or phone number involved
• A way to reach you if we have questions

We reply within two business days. Please give us the chance to fix a problem before you describe it publicly. We will never ask you for your password or a verification code, by email or by phone.

For anything else, write to support@pombi.app.