Security
Your deals are confidential. We built it that way.
AssetHub holds the kind of information you do not hand out lightly — live deals, counterparties, documents, and money owed. Every plan is protected the same way, from the first day of your trial. Here is exactly how.
Row-level data isolation
Every workspace's data is walled off from every other at the database level. Postgres row-level security enforces the boundary — the database itself refuses to return another tenant's rows, and the app connects through a restricted, non-superuser role. It is not app code you have to trust; it is the database saying no.
Encrypted in transit and at rest
Every connection is served over TLS (HTTPS), and your data is encrypted at rest on managed cloud infrastructure. Nothing moves or sits in the clear.
Credentials are never stored in the clear
Passwords are hashed with bcrypt before they ever touch the database — we cannot read them, and neither could someone who reaches the data. Sign-in runs a constant-time check so the system never leaks which emails have accounts.
Server-side, revocable sessions
Sessions live in the database, not in a token floating on your device. Sign out — or have an owner remove a teammate — and access is cut immediately, everywhere.
Share links are hashed, scoped, and revocable
When you share a single deal, the link's secret is stored only as a one-way hash, scoped to read-only or read-write, and revocable at any time. A database leak would expose no working links.
AI that never trains on your data
AI deal matching is opt-in and off by default. Your deals, documents, and contacts are never used to train any model, the requests that power a match are never stored, and the feature only runs when you turn it on.
Want to hold the keys yourself? Self-host on Enterprise.
On Enterprise, you run AssetHub against your own database on your own infrastructure. Same software, same experience — your data simply lives on servers you control and never leaves them. For desks and institutions that answer to their own compliance, it is full data sovereignty.
See EnterpriseResponsible disclosure
Security is never finished. If you believe you have found a vulnerability, please email security@asset-hub.dev and we will respond quickly. Please give us a reasonable window to fix an issue before disclosing it publicly.