The data: yours, with full export
Everything you put in is your property. If the agreement ends, you get a full export of the database, all files and all documentation — in standard formats another provider can build on.
How the systems we build are actually set up
Anyone can write "safe and secure". This page describes how our systems are actually set up — in plain language, and only what we can document.
01Database and data storage
Your data lives in a standard database in the EU
PostgreSQLSupabaseAWS eu-west-1 (Ireland)
The database is PostgreSQL, provided by Supabase, and runs in the AWS region eu-west-1 in Ireland — that is, in the EU.
PostgreSQL is an open, well-documented database format. That means your data is not stuck in anything proprietary — it can be exported and moved to another provider.
02Access control
Who sees what is decided in the database
Row Level SecurityOver 200 policiesRoles and account isolation
Access control is enforced at the database level with Row Level Security. Over 200 policies in the database schema decide who can read and change what — and the rules apply even if something in the application code fails.
Access in the app is managed with roles, and each account is isolated from the others at the database level. One customer's data is not visible to another.
Broken access control sits at the top of the OWASP Top 10 — the list of the most common security flaws in web applications. That is why we put the control in the database, not just in the code. Source: OWASP Top 10 — Broken access control
03Encryption in transit
Traffic is encrypted on the way
HTTPS/TLSHSTS enabled
All traffic to webagent.no runs over HTTPS/TLS, and HSTS is enabled. That means your browser refuses to connect unencrypted — even if someone were to try to force it.
"In transit" means on the way between the browser and the server. That is where traffic can be intercepted, and where the encryption does its job.
04Traceability
Actions in the system are logged
Activity logAI actions are loggedChange history
The systems keep an activity log at the application level: who did what, when it happened, and what was changed. That also applies to actions performed by AI — they are logged with the same traceability as human users.
The log covers what happens in the application. We do not claim it covers more than that — it is traceability for actions in the system, not infrastructure monitoring.
05Hosting
Where the system actually runs
VercelSupabase — AWS eu-west-1Resend — EU region
The application is hosted on Vercel. The database runs at Supabase in AWS eu-west-1 (Ireland), and email is sent via Resend from the EU region.
We deliberately do not say "everything runs in the EU". What is in the EU is the database and the email sending — that is, where your data is actually stored and sent from.
06Ownership
You own the data and the domain
You rent the solution from us — but what is yours, stays yours. The data you put in and the domain you use are your own. That means you are never locked in with us.
The domain: your own
You own your domain, not us. You always decide where it points, and it can be moved at any time — independently of us.
07Questions and answers
Frequently asked questions
Where is our data stored?
In a PostgreSQL database at Supabase, in the AWS region eu-west-1 in Ireland — that is, in the EU. Email is sent via Resend from the EU region, and the application is hosted on Vercel.
Can other customers see our data?
No. Each account is isolated at the database level with Row Level Security — over 200 policies decide who can read and change what. The isolation is enforced by the database itself, not just by the application code.
Is the traffic encrypted?
Yes. All traffic to webagent.no runs over HTTPS/TLS, and HSTS is enabled so the browser refuses unencrypted connections.
What happens to our data if the agreement ends?
You get a full export of the database, all files and the documentation. The data is your property and is delivered in standard formats.
Can another developer take over the system?
The solution is what you rent from us, but the data and the domain are yours. The database is standard PostgreSQL and the documentation is included in the export, so another provider can build on your data.
Free and non-binding – your website is finished before the first payment