Security & data protection
Hold. is built for people and teams who share sensitive physiology data – heart-rate variability, sleep, stress scores – and that data demands real protection. This page summarises how the platform handles it, written for security and procurement review.
Data residency & hosting
- All participant data is stored in Frankfurt, Germany (EU) on Supabase (SOC 2 Type II certified infrastructure, running on AWS eu-central-1).
- The application is served via Netlify, whose server code currently runs in the US; video content is delivered through Cloudflare Stream.
GDPR
- Explicit consent is captured during onboarding before any health data is collected.
- Participants can disconnect a wearable instantly in Profile and request full deletion at any time – deletion cascades through all individual records (the right to erasure, implemented as a single action).
- Hold. is provided by Loepfe Consulting - FZCO(United Arab Emirates), the data controller.
- Data processing agreements are available on request.
Anonymisation – what employers see
- Participants and Nadine see their check-ins, wearable data and answers. The employer sees group averages only, and only for groups of five or more – never individual data.
- Aggregates are suppressed below n = 5: if a group is smaller than five people, the employer sees nothing rather than something traceable. This is enforced in the application layer, not left to convention.
Access control
- Row-level security is enabled across the database; sensitive tables (messages, practitioner notes, health metrics) have no client-side access policies at all – they are reachable only through the server with role checks on every request.
- Authentication is passwordless by default (email magic links) or with Google or Microsoft; password sign-in exists only for accounts explicitly given one. Accounts are invite-only – there is no self-service sign-up.
- Practitioner-participant messages and session notes are visible only to the two parties involved (notes: the practitioner only).
Subprocessors
- Supabase (database & auth – EU) · Netlify (hosting – US) · Cloudflare Stream (video) · Resend (transactional email – US) · Whoop / Apple Health (wearables, participant-initiated) · Cal.com (1:1 scheduling) · Zoom (live sessions) · Proton (mailboxes).