ebic.io
Start free

Trust center

Who we rely on, and their proof.

ebic.io keeps as little of your data as it can, and runs on a short list of providers. This page lists every one of them, what it holds, and where its audit reports and security certificates are published.

Links and certificate lists checked on October 25, 2026.

Start here

What we hold, and what we never see

We hold

  • Your email address and how you sign in
  • Your subscription status, from Paddle
  • If you turn on settings sync: an encrypted copy of your settings that we cannot read

We never see

  • Your dashboards or the data behind them
  • Your catalog’s metadata, owners, lineage or conversations
  • Your catalog access tokens, except inside that encrypted copy
  • Card numbers: Paddle takes payment

Reports are rendered by your BI tool and catalog details are read from your catalog, both straight to your device. The privacy policy has the full list of what we keep and for how long.

Vendors

The services ebic.io runs on

Each one is bound by contract to protect the data it handles for us and to use it only for us. Links marked On request go to reports the vendor shares only under NDA or with its signed-in customers.

Google Cloud and Firebase

Hosts this website, the app and the demo. Runs sign-in (Firebase Authentication), our server-side code (Cloud Functions, Cloud Run) and the database that holds account and subscription records (Firestore).

Holds
Your email address, sign-in details, subscription status and, only if you turn on settings sync, the encrypted copy of your settings that we cannot read.
Data location
United States
Certified
  • ISO/IEC 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • SOC 1
  • SOC 2
  • SOC 3
  • PCI DSS

Firebase Hosting, which serves the static files of this website and the app, is covered by ISO 27001 and the SOC reports but not by ISO 27017 and 27018. Authentication, Firestore, Cloud Functions and Cloud Run are covered by all of them.

Paddle

Our reseller and Merchant of Record: takes payment, collects sales tax and VAT, and tells us whether a subscription is active.

Holds
Your payment details, billing name and address, and invoices. We never see card numbers.
Data location
United Kingdom and United States
Certified
  • SOC 2 Type 2
  • PCI DSS (SAQ A)

Paddle publishes the summary of its SOC 2 audit and shares the full reports with sellers under NDA through its trust center. The PCI DSS attestation covers hosted checkout only (SAQ A): card data goes to Paddle, never through our pages or servers.

Google Analytics

Counts visits to this website and the demo, only after you click Accept on the cookie banner. Not used in the app you sign in to.

Holds
Pages visited, where you came from, your approximate country, browser and device. IP addresses are used to estimate location and are not stored.
Data location
United States
Certified
  • ISO/IEC 27001

Advertising features are off and nothing is tied to your account. The cookie banner and the Decline choice are described in our privacy policy.

GitHub

Holds our source code and runs the checks and builds for every release.

Holds
Nothing of yours. Our code and build logs only; no customer data is in the repositories.
Data location
United States
Certified
  • SOC 1 Type 2
  • SOC 2 Type 2
  • ISO/IEC 27001:2022
  • CSA STAR Level 2
  • PCI DSS

The audit reports themselves are downloaded from an enterprise account’s settings, so they are listed here, not mirrored.

Name.com (Identity Digital)

Our domain registrar and DNS host for ebic.io.

Holds
Nothing of yours. It answers DNS lookups for our hostnames.
Data location
United States
Certified
  • ICANN-accredited registrar

Name.com publishes no SOC or ISO attestation that we could find. It holds no data of yours: a DNS record only points traffic at the servers we run with the other vendors on this page.

Google Trust Services and Let’s Encrypt

Issue the HTTPS certificates: Google Trust Services for ebic.io, app.ebic.io and demo.ebic.io through Firebase Hosting, Let’s Encrypt for the demo catalog servers.

Holds
Nothing of yours. A certificate contains only our hostnames.
Data location
United States
Certified
  • WebTrust for CAs
  • CA/Browser Forum baseline requirements

Only for the live demo

The demo at demo.ebic.io shows a fictional company’s catalogs and dashboards. These providers host that demo and never touch customer accounts.

Amazon Web Services

Runs the demo catalogs behind demo.ebic.io (OpenMetadata, DataHub, Apache Atlas, Unity Catalog) and the sample BI dashboards they point at.

Holds
Nothing of yours. The demo is seeded with made-up data for a fictional company, and demo accounts are read-only.
Data location
United States (Ohio)
Certified
  • ISO/IEC 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • SOC 1
  • SOC 2
  • SOC 3
  • PCI DSS Level 1
  • CSA STAR

Not listed: your BI tools and your data catalogs. They stay under your own contracts and controls; ebic.io connects to them from your device and holds none of their data.

Our side

How we run ebic.io

What we do ourselves, today. These are our own descriptions, not an auditor’s findings.

No report data, ever

Dashboards are rendered by your BI tool straight to your device, and catalog details are read from your catalog by your device. Nothing passes through our servers, so there is nothing of it for us to secure, leak or subpoena.

Encrypted in transit

Every address we run is HTTPS only. This website, the app and the demo also send HSTS, so browsers refuse to fall back to plain HTTP. The app talks to your catalog at the address you give it, directly from your device.

Settings sync you can trust

If you turn on settings sync, your settings are encrypted on your device with a key made from a passphrase only you know. We store the encrypted copy and never the passphrase or the key.

Server-side only access

Account and subscription records can be read and written only by our own server-side code, through Firestore security rules that refuse direct access from a browser or app.

Least data, shortest time

We keep your email, your subscription status and, for 90 days, the payment notifications Paddle sends us. Closing your account deletes them within 30 days. The full list is in the privacy policy.

Every change reviewed

Code goes through pull requests with automated checks before it reaches a release, and releases are built from a reviewed branch. Secrets live in the cloud provider’s secret store, never in the code.

What we don’t have yet

  • ebic.io has not been audited for SOC 2 or ISO 27001 itself. Everything above about our own practices is our description, not an auditor’s. This page will say so when that changes.
  • We do not yet run a public bug bounty. Reports of a vulnerability are welcome at the security address below and are answered.
  • We do not yet publish a status page or incident history.

Found a vulnerability, or have questions an auditor or a security review needs answered? Email security@ebic.io. We answer security questionnaires for Enterprise Edition evaluations. Anything else goes to support@ebic.io.