RevenueHQ is built for businesses that spend real money on marketing and need to know their data is handled properly. Here’s exactly how we do it.
RevenueHQ uses email and password authentication. Passwords are hashed using bcrypt via Supabase Auth — we never store plaintext passwords and never see your raw credential. You can also sign in with Google. Session tokens are short-lived and rotated automatically.
Most marketing platform integrations (Google Ads, Meta, Calendly, etc.) connect via OAuth. You authorize each connection through the provider’s own consent screen. Some integrations (e.g. WordPress) use app-specific credentials you can revoke at any time.
In transit: All connections to RevenueHQ use TLS 1.2 or higher. We enforce HSTS and do not support unencrypted HTTP.
At rest: All data stored in our database is encrypted at rest by our database provider (Supabase). Database backups are encrypted with the same standard.
Integration credentials are scoped per workspace and stored in our database with encryption at rest provided by our hosting provider. Individual users never see raw API keys or OAuth tokens for connected platforms.
These are the third-party services that process data on behalf of RevenueHQ:
| Provider | Purpose | Data processed |
|---|---|---|
| Infrastructure and AI providers | ||
| Supabase | Primary database & auth | All application data, user accounts |
| Vercel | Application hosting & edge network | Application code, static assets, API routing |
| Cloudflare | DNS & edge security | Request routing metadata |
| Anthropic | AI model provider (Cannon) | Marketing context for AI analysis |
| OpenAI | AI model provider | Marketing context for AI analysis |
| Perplexity | AI-powered research | Marketing queries |
| Replicate | Image generation | Image prompts and outputs |
| Stripe | Billing & customer payments | Payment methods, invoices, subscription state |
| Resend | Transactional email | Email addresses, notification content |
| DataForSEO | SEO & search data | Domain and keyword queries |
| SpyFu | Competitive intelligence | Domain queries |
| BrightLocal | Local SEO data | Business listing queries |
| Integrations you choose to connect | ||
| Ads, Analytics, Business Profile, Drive | Ad performance, website analytics, listing data, photos | |
| Meta | Ads & social publishing | Ad performance, post content, page insights |
| Zoho | CRM sync | Leads, contacts, pipeline stages |
| Calendly | Booking sync | Appointments, cancellations |
| Intuit QuickBooks | Revenue reporting | Revenue summaries |
| Mailchimp | Email marketing | Campaign performance |
| Social publishing | Post content | |
| X (Twitter) | Social publishing | Post content |
| Social publishing | Post content | |
| Weave | Communications | Call and message records |
| Slack | Notifications & Cannon chat | Notification content |
Integrations in the second group only receive data when you connect them. This list is updated when subprocessors change. Last updated: October 2026.
Some of our customers operate in regulated industries. Depending on the integrations you connect, RevenueHQ may process lead and contact details from your CRM, booking tool, and phone or messaging system. If your business has specific compliance requirements, talk to us before connecting those systems.
If you’ve found a security vulnerability in RevenueHQ, we want to hear about it. Please report it responsibly so we can investigate and fix it before public disclosure.
Email: security@revenuehq.ai
We aim to acknowledge reports within 24 hours and provide a resolution timeline within 72 hours. We do not pursue legal action against good-faith security researchers.