Security

Last updated: October 23, 2026

Independent security assessment

CASA AL1 validated

Cubbie’s web app passed an independent Cloud Application Security Assessment (CASA), performed by TAC Security, a lab authorized by the App Defense Alliance.

Standard: ADA-CASA, App Defense Alliance
Level: AL1 (Lab Tested - Lab Verified)
Assessor: TAC Security
Issued: Oct 23, 2026
Valid until: Oct 24, 2027

View letter of validation

How we protect data

Encryption in transit: cubbie.com is served only over HTTPS (TLS), with HTTP Strict Transport Security.
Encryption at rest: Data in our database is encrypted at rest by our database provider.
Access controls: Access to account and workspace data is limited by sign-in, workspace membership and role permissions.
Sign-in protection: Email and password sign-in, sign-up and password reset are protected by an automated bot check, and two-step verification is available for every account.

Google user data

Cubbie’s use and transfer to any other app of information received from Google APIs (including Google Workspace APIs and the Gmail API) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Details are in Section 4.1 of our Privacy Policy.

Report a security issue

Email [email protected] with “Security report” in the subject line. A person reads those reports.