Updated 2026-10-07. CaliberVault is run by Insightful Solutions Ltd. Questions: calibervault@insightful-apps.com.
How we protect your data
- Every connection is encrypted (HTTPS).
- The database lets each account see only its own data; this is enforced by the database itself, not only by the app.
- Serial numbers and storage addresses are encrypted a second time inside the database.
- Two-step sign-in is available on plans that include it, and is required for our administrators.
- Automatic daily database backups are kept for 7 days, and a weekly copy of your own data is made for plans that include backups.
- Changes reach customers only after automated tests, a security review of the change and a check of the live sign-in; every release is recorded.
- Security events (failed sign-ins, administrator actions, use of full-access keys) are reviewed every day and recorded.
What we commit to if something goes wrong
- Security incidents. If we learn of a breach that affects your personal information, we decide within 72 hours whether notice is required, and we tell you without unreasonable delay where it is. We tell affected customers by email.
- Availability. Our target is 99.5% availability each calendar month (about 3 hours 36 minutes of downtime in a 30-day month). It is a target we measure ourselves against, not a guarantee. We check the app and the sign-in service every 10 minutes, and we walk a full sign-in through the real page every day and after every release.
- Recovery. Our target is to have the service back within 4 hours of deciding to restore, and to lose no more than 24 hours of changes in the worst case.
- Outages. We tell customers by email when an outage lasts long enough to matter and when it is over.
Service providers that process your information
| Provider | What it does for CaliberVault | What it receives |
|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage (United States, AWS us-east-2) | All information you store in CaliberVault |
| Vercel Inc. | Hosting of the app (United States) | IP address and technical details of your requests |
| Stripe, Inc. | Payments | Name, email and the payment details you enter with Stripe |
| Resend | Email delivery | Your email address and the content of emails we send you |
| Microsoft Corporation (Microsoft 365, through Microsoft Graph) | Receives mail sent to our support address and sends our replies to it | The email address and the message of anyone who writes to support, and our reply |
| Anthropic, PBC | AI features, only when you use one (including the automatic first answers to support messages) | Only what the feature needs (for example an item description, a photo you choose, a question you type, or the text of a message you send to support); never serial numbers, email address or account identity |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical details of errors; email, username and IP address are removed first |
| Intuition Machines, Inc. (hCaptcha) | Protection against automated abuse on sign-in and sign-up (password-reset requests are limited per address and per network instead) | Browser and device signals and IP address when those forms are shown |
| UPCitemdb | Product lookup when you scan a barcode | The barcode number only |
Our Privacy Policy describes your rights, including how to withdraw your consent (Account, then Withdraw My Consent) and how to delete your account.
Report a security problem
Email calibervault@insightful-apps.com with what you found and how to reproduce it. We acknowledge a report within 2 business days. Please do not access other customers' data or disrupt the service while testing. Our machine-readable contact is at /.well-known/security.txt.