How Fibbler keeps your data safe

A summary of how we handle your data: what we read in the tools you connect, what we write back, what we store and where it lives. No jargon, no fluff.

Last updated: October 2026

Looking for our SOC 2 report?

Our certifications, the full list of controls from our SOC 2 audit, our security policies and our current sub-processors are published in our Trust Center. That is the one place we keep them up to date, so this page links there instead of keeping a second copy. What you will only find here is what Fibbler reads and writes in the ad platforms and CRMs you connect.

The short version

All customer and application data is hosted in the EU on Google Cloud, in the Belgium region
The only personal data in the core product is your account email. What we take from your CRM is company and deal data, not contacts
We store your LinkedIn, Google Ads, Meta Ads and CRM data to power attribution, analytics and MCP. It is encrypted at rest with AES-256, and the database cannot be reached directly from the internet
If you disconnect or cancel, stored CRM data is deleted within 30 days
Nothing is read until you connect an integration, and you can revoke it at any time
Two features write to your CRM, CRM Sync and Ad Engagement Signals, and both stay off until you turn them on. On a record that already exists we only ever write our own fields
Two-factor authentication (TOTP) is available on every plan, and workspace owners can require it for every member of their workspace
MCP (connecting your data to LLMs like Claude, ChatGPT and Cursor) is available on the Unlimited and Agency plans and during the free trial. When you use it, the AI tool you connect processes the answers it pulls from Fibbler, under your own agreement with that provider
Website visitor company identification is powered by our partner Dealfront (Leadfeeder). It runs on fibbler.co, and on your own website only if you install the Fibbler tracking script for the Google Ads or Meta Ads add-on. Dealfront is ISO 27001 and ISO 27701 certified, hosts all data in the EU, and we have a Data Processing Agreement in place
We do not sell, resell or profile your data, and we never will
SOC 2 Type 1 compliant, audited by Sensiba in September 2026, with our GDPR alignment checked in the same audit. Our SOC 2 Type 2 audit is underway. ISO 27001 is booked with the same auditor and has not started yet. The report, every control and our policies are in the Trust Center

Frequently asked questions

Where is data stored?

All customer and application data is hosted in the EU on Google Cloud, in the Belgium region. Four things are processed outside the EEA under appropriate safeguards, and Where your data lives names them.

Do you process personal data?

The only personal data we handle is your email address for account management. We do not process individual contact records from your CRM, personal identifiers, LinkedIn messages, or sensitive information of any kind. The company-level and deal data we take from your CRM is business data.

What do you read in LinkedIn, Google Ads, Meta Ads and my CRM?

Only the company-level and deal data needed for the features you enable. What we read and write in your tools lists it object by object and field by field, for every platform.

Do you store any of that data?

Yes, encrypted at rest with AES-256, and deleted within 30 days if you disconnect or cancel. What we store, and for how long has the detail, including how to opt out of CRM storage.

Do you push anything back into my CRM?

Only if you turn it on, and only ever into fields Fibbler created. What we write back into your CRM covers both features that do it.

Do you sell customer data?

No. Never. We don't sell, resell or profile your data, and we never will.

Do you support two-factor authentication (2FA)?

Yes, on every plan at no extra cost. Fibbler uses time-based one-time passwords (TOTP), so any standard authenticator app works, and workspace owners can require it for every member of a workspace. Full details are in the Authentication section below.

Do you have a security certification?

Yes. We're SOC 2 Type 1 compliant. Our auditor, Sensiba, went through our controls for security, availability and confidentiality and gave us a clean report in September 2026. The same audit checked us against the GDPR's data protection principles, and we passed that too. You can request the full report, and read every control and policy behind it, in our Trust Center. Our SOC 2 Type 2 audit is underway. We have also booked ISO 27001 with the same auditor, but that audit has not started, so we are not ISO 27001 certified yet. Google Cloud, our hosting provider, is SOC 2 Type II and ISO 27001 certified.

Do you run penetration tests?

Yes. Our latest penetration test was done by Atoro, an independent security firm, in June 2026, and we run one every year. On top of that we do our own security reviews and scan our code and infrastructure for vulnerabilities all the time.

Do you have an incident response or recovery plan?

Yes. Our business continuity, incident management and risk management policies are published in our Trust Center. In practice: stateful systems are backed up daily, we can restore customer-critical infrastructure within 24 hours, and in the event of a personal data breach we notify affected customers without undue delay and within 72 hours.

What we read and write in your tools

This is the part no certification answers for you, so it is the part this page keeps in full. We only access the company-level and deal data required to power the analytics, attribution and reporting features you explicitly enable.

LinkedIn Ads

We access your LinkedIn Ads account via the LinkedIn Marketing API:

Data	Access	Fields	Why it's used
Campaigns	Read	name, ID, status, objective	To display and attribute campaign performance
Performance Metrics	Read	impressions, clicks, spend, engagements	For attribution and ROI reporting
Company Engagement	Read	company name, domain, engagement data	To match ad engagement to CRM accounts
Campaign Targeting	Write	targeting exclusions (job titles, companies)	For Audience Exclusions and Impression Caps features (only when enabled by you)

HubSpot, Salesforce, Attio & Pipedrive

We access the following data from your CRM:

Object	Access	Fields	Why it's used
Company/Account	Read	name, domain, ID	To match CRM records to campaigns
Opportunity/Deal	Read	name, amount, status, created/close dates, ID	For revenue attribution and funnel reporting
Custom Fields	Read	field names, and the values of the deal fields we use	To allow mapping of ad data into the CRM
Custom Fields	Write	Fibbler-created fields on Company/Account (HubSpot, Salesforce, Attio & Pipedrive)	For CRM Sync: creates fields to store LinkedIn, Google Ads or Meta Ads engagement data (only when enabled by you)
Custom Fields	Write	Fibbler-created signal fields on Company/Account: signal type, date, name, channels and reason	For Ad Engagement Signals: records why an account was surfaced, so you can filter on it (only when enabled by you)
Company/Account	Create	name, domain, industry, employee count, LinkedIn page - on new records only	For Ad Engagement Signals, only once you turn a signal on. When a signal sends to your CRM it creates the account if it's missing, and marks it as created by Fibbler
List / View / Filter	Create & update	One list of companies per signal, and which companies are in it. Only lists we created, addressed by an id we stored	For Ad Engagement Signals: the queue your team works from. Accounts leave it after 30 days; the records themselves are untouched
Note	Create	A note on the Company/Account (Salesforce, Attio & Pipedrive)	For Ad Engagement Signals: the one-line reason a rep reads. Not in HubSpot, where the only permission for notes is write access to every contact, which we do not ask for

CRM Sync and Ad Engagement Signals are both off until you turn them on, and both apply to all supported CRMs (HubSpot, Salesforce, Attio, and Pipedrive). Everything else we do in your CRM is read-only.

A word on lists, because the permission is broader than the use. In HubSpot a list can hold contacts, companies or deals, and the permission covers all three because HubSpot offers no narrower one. Every list we create is a list of companies, and the only lists we ever touch are the ones we created, addressed by an id we stored when we made them. We never search or browse the lists in your account, so a list we did not make is one we cannot name and will never open. Read access is there so our support team can look up one of those lists when a customer tells us it is not filling; a signal running normally never reads a list at all.

On a record that already exists we only ever write our own fields. Your name, domain, owner, lifecycle stage and everything else your team maintains are never changed by us. The firmographic details above are written only on a record we create.

Google Ads (optional add-on)

We access campaign and performance data via the Google Ads API. We only read your Google Ads data and never change anything in your account.

Data	Access	Fields	Why it's used
Campaigns	Read	name, ID, status, type	To display campaign performance and attribution
Ad Groups / Keywords	Read	name, ID, text, match type, metrics	To group performance and connect search terms to pipeline
Performance Metrics	Read	clicks, impressions, spend, conversions	For attribution and ROI reporting
Website Visitor Data (via Dealfront)	Read	company name, industry, visit behavior	To match website visits to Google Ads campaigns and CRM deals

Meta Ads (optional add-on)

We access campaign and performance data via the Meta Marketing API. We only read your Meta Ads data and never change anything in your account.

Data	Access	Fields	Why it's used
Ad Accounts	Read	name, ID, currency, status	So you can pick which ad accounts we read
Campaigns	Read	name, ID, status, objective	To display campaign performance and attribution
Performance Metrics	Read	impressions, clicks, engagements, spend	For attribution and ROI reporting
Website Visitor Data (via Dealfront)	Read	company domain, landing page, and the campaign and ad from your UTM tags	To match website visits to Meta Ads campaigns and CRM deals

Integrations you connect

The platforms above are not sub-processors. Each one already holds your data as your own system of record, and we only connect after you authorise us through that platform's own OAuth flow. Nothing is read until you connect the integration, and you can revoke access at any time from the Data sources page or from the platform itself.

Ad platforms: LinkedIn Ads, Google Ads, Meta Ads
CRMs: HubSpot, Salesforce, Attio, Pipedrive

What we store, and for how long

We store LinkedIn ads data, Google Ads campaign data, Meta Ads campaign data, and CRM data in our database to power attribution, analytics, and MCP features. That includes campaign performance metrics, audience exclusions, attribution data, CRM company records (name, domain), and deal or opportunity records (amount, stage, dates).

CRM data is synchronized on a regular schedule and kept up to date while your integration remains connected. If you disconnect or cancel, stored CRM data is deleted within 30 days. If you prefer not to have CRM data stored at all, you can opt out by contacting support@fibbler.co.

All stored data is encrypted at rest using AES-256 encryption.

What we write back into your CRM

Only if you explicitly enable it. Two features write to your CRM.

CRM Sync pushes LinkedIn, Google Ads or Meta Ads engagement data into HubSpot, Salesforce, Attio or Pipedrive by creating custom fields on your Company or Account records.

Ad Engagement Signals does more, so it is worth being plain about. For each signal you build it creates a list, view or filter named after that signal, keeps the right accounts in it, and writes its own fields on each one saying why it was surfaced. In Salesforce, Attio and Pipedrive it also leaves a note on the record. If an account is missing from your CRM, the signal creates it and marks it as created by Fibbler, so you can find them all again. Signals are optional: nothing happens until you set one up and turn it on.

Fully user-controlled
Never changes a field your team owns on a record that already exists

Authentication & 2FA

Sign-in is by email and password. Two-factor authentication is available to every user on every plan at no extra cost, and workspace owners can require it for their whole team:

Time-based one-time passwords (TOTP, RFC 6238). 6-digit codes on a 30-second rotation, working with any authenticator app such as 1Password, Google Authenticator, Microsoft Authenticator, or Authy. We do not use SMS or email codes as a second factor
With 2FA enabled, a password alone does not create a session. The session cookie is only issued once the code is accepted, and password resets do not bypass it
Sensitive actions require re-verification if more than two hours have passed. Sessions last a maximum of 7 days and are tracked server-side so they can be revoked centrally
Turning 2FA off requires a valid code and signs out every other session on the account. Password changes do the same
Workspace owners can require 2FA for every member of a workspace. The check runs server-side on every request in the app, so members without it are blocked from the workspace until they enable it
We do not offer recovery codes, SAML or OIDC single sign-on, or hardware security keys today. If you lose your authenticator device, email support@fibbler.co and we will help you regain access

Where your data lives

Fibbler runs on Google Cloud Platform, in one EU region (Belgium), for both the app and the database. Google Cloud is SOC 2 Type II and ISO 27001 certified, and you can read how Google manages security here. Our own infrastructure is immutable: servers are replaced rather than changed in place.

Transfer Impact Assessment (TIA)

We have conducted a Transfer Impact Assessment as required by GDPR Article 46. All customer and application data is hosted within the EEA. This covers your ad platform data, your CRM data and everything you see in the Fibbler app. Four things are processed outside the EEA under appropriate safeguards (Standard Contractual Clauses or the EU-US Data Privacy Framework): support conversations in Intercom, marketing email in Loops, payment and billing details in Stripe, and the advertising tags on our marketing website. Some of the business tooling we run the company on is US-based and covered by the same safeguards, but none of it holds your ad platform or CRM data.

Sub-processors

Every vendor that processes customer data on your behalf is published, with its location and purpose, in our Trust Center sub-processor list. We keep one list, in one place, so you never have to work out which of two pages is current. Customer and application data is processed exclusively within the European Economic Area unless the Transfer Impact Assessment above says otherwise.

All sub-processors are bound by GDPR-compliant data processing agreements. We notify customers at least 14 days before we add or replace a sub-processor that processes customer data, and you may object to the change. We give that notice by publishing the change in the Trust Center list and by email. This commitment applies to changes made after 28 September 2026, the date we baselined the list. The change log below records every change since.

The ad platforms and CRMs you connect are not sub-processors, and Integrations you connect explains why. Separately, we run the company on ordinary business tooling: email, chat, source control, dependency scanning and issue tracking. None of it holds your ad platform or CRM data. Where it holds personal data at all, such as your email address in a message you sent us, we are the controller of it and our Privacy Policy covers it rather than a data processing agreement, so the 14 days' notice commitment does not extend to those vendors. They are in our vendor register and we will name them on request.

Website visitor identification

Dealfront (Leadfeeder) is the one sub-processor that can run on your own website rather than ours. It identifies visiting companies from IP addresses, and it only reaches your site if you install the Fibbler tracking script for the Google Ads or Meta Ads add-on. Dealfront is ISO 27001 and ISO 27701 certified, hosts all data in the EU, and we have a Data Processing Agreement in place.

The app at app.fibbler.co sets no tracking cookies. The analytics and advertising tags on our marketing website are a separate matter, they never touch your ad platform or CRM data, and our Privacy Policy covers them.

Change log

Date	Change
5 October 2026	The sub-processor list now lives in the Trust Center only. No vendor was added, removed or replaced by this change: we had the same list in two places, which is how two places end up disagreeing. Notice of future changes is given by publishing them in that list and by email, as before. This page keeps what the Trust Center does not cover, which is what Fibbler reads and writes in the platforms you connect.
28 September 2026	Baseline. We reviewed our sub-processors against our full vendor register and corrected the list. Newly disclosed as sub-processors, both already in use before this date and neither newly engaged: Intercom and Amazon Web Services. Reclassified as business tooling rather than sub-processors, because they do not process your data on your behalf: Google Workspace, Slack, GitHub, GitHub Dependabot, npm and Jira. Removed the Google Ads API entry, because the ad platforms and CRMs you connect are data sources rather than sub-processors. Recorded that Intercom's AI agent, Fin, is in use, and that support conversation content therefore reaches the model providers Intercom lists as its own sub-processors. Named a country and region for every vendor that previously said only "EU-hosted", and corrected the Stripe entry, which claimed no personal data was shared. The 14 days' notice commitment applies to changes made after this date.

Date

Change

5 October 2026

The sub-processor list now lives in the Trust Center only. No vendor was added, removed or replaced by this change: we had the same list in two places, which is how two places end up disagreeing. Notice of future changes is given by publishing them in that list and by email, as before. This page keeps what the Trust Center does not cover, which is what Fibbler reads and writes in the platforms you connect.

28 September 2026

Baseline. We reviewed our sub-processors against our full vendor register and corrected the list. Newly disclosed as sub-processors, both already in use before this date and neither newly engaged: Intercom and Amazon Web Services. Reclassified as business tooling rather than sub-processors, because they do not process your data on your behalf: Google Workspace, Slack, GitHub, GitHub Dependabot, npm and Jira. Removed the Google Ads API entry, because the ad platforms and CRMs you connect are data sources rather than sub-processors. Recorded that Intercom's AI agent, Fin, is in use, and that support conversation content therefore reaches the model providers Intercom lists as its own sub-processors. Named a country and region for every vendor that previously said only "EU-hosted", and corrected the Stripe entry, which claimed no personal data was shared. The 14 days' notice commitment applies to changes made after this date.

Technical & Organizational Measures (TOMs)

The full list of controls from our SOC 2 audit, and the policies behind them (access control, vendor management, incident management, risk assessment, endpoint security and the rest), are published in our Trust Center. These are the measures customers ask us about most:

Controls independently audited for SOC 2 Type 1 (Sensiba, September 2026)
All data transfer and database connections encrypted with TLS, and everything stored encrypted at rest with AES-256
The database cannot be reached directly from the internet. Access goes through Google's IAM-authenticated proxy, and only encrypted connections are accepted
Database accounts hold the minimum permissions they need, and all access is logged
Two-factor authentication (TOTP) available to all users and enforceable workspace-wide. Passwords hashed with bcrypt and checked against the Have I Been Pwned breached-password database, with rate limiting on every authentication endpoint
Daily backups of stateful systems, encrypted and stored separately. We can restore customer-critical infrastructure within 24 hours
Real-time monitoring and alerting, regular security patching, and dependency scanning with vulnerability alerts
Annual third-party penetration testing (latest by Atoro, June 2026)

Only authorized personnel with a specific business need can reach the database or production infrastructure. They may access production data to investigate a fault or answer a support request, and that access is logged.

Documents, DPA and NDA

We also offer a standard DPA (aligned with GDPR) and a Mutual NDA for vendor evaluation. Email support@fibbler.co to request these or if you have any other security questions.