NewsbookLM is built and run by Eze Media LLC. Agencies trust us with their clients' names, competitors and strategy, so this page explains how we protect that data, in plain terms. If your team needs a security questionnaire filled in, email security@newsbooklm.com.

Hosting and data location

Your account data (personas, sources, reports and settings) lives in a PostgreSQL database run by Supabase on Amazon Web Services in the United States (Oregon, us-west-2). Sign-in and our server functions run there too.
The website itself is served by Vercel from its global network.
Payments are handled by Stripe. You type card details into Stripe's own checkout; we never see or store card numbers.
Our core vendors hold their own independent audits: Supabase (SOC 2 Type 2 and ISO 27001), Vercel (SOC 2 Type 2) and Stripe (PCI DSS Level 1 and SOC 2 Type 2). NewsbookLM does not have its own SOC 2 report yet.

Encryption

In transit: every connection uses HTTPS with TLS 1.2 or 1.3; older versions (TLS 1.0 and 1.1) are refused. newsbooklm.com and all its subdomains are on the browser HSTS preload list, so browsers never connect to us without encryption. Connections between our server functions and the database are encrypted too.
At rest: Supabase encrypts all stored data with AES-256.

Keeping each account's data separate

Every table in our database has row-level security turned on. Each row of customer data belongs to one account, and the database itself makes sure anything your browser asks for can only reach your own rows.
Server functions that need wider database access first check who you are, then limit every query to your own account.
Every week an automated check visits as a signed-out stranger and tries to read every table. Any customer data that comes back opens an alert for us to fix.

Signing in

You sign in with an email and password, or with your Google or GitHub account. Sign-in runs on Supabase Auth, which stores passwords only as one-way hashes; we never see your password.
You can turn on two-step verification in Settings. After your password (or Google or GitHub), sign-in also asks for a 6-digit code from an authenticator app on your phone. Our database and servers check that the code was entered, so a stolen password alone can't reach your data.
Only Eze Media's founder can reach our production systems. The admin tools (1 account, checked on the server, and usable only after two-step verification) show account details, personas and usage for support and billing. We look at the content of your reports only when you ask us to help with a problem, or when the law requires it.

How AI providers handle your data

Reports are written by AI models from Google (Gemini), Anthropic (Claude) and OpenAI. We send them the article text and the persona and briefing settings you write, never your password or payment details.
We use each provider's paid business API. Google, Anthropic and OpenAI do not use that content to train their models. Eze Media does not train models on it either.
Providers keep prompts and responses only to detect abuse: Google for up to 55 days, Anthropic and OpenAI for up to 30 days (longer only if content is flagged or the law requires it).

Backups and recovery

Supabase backs up the whole database every day and keeps each backup for 7 days. At most 24 hours of data could be lost in a disaster.
We follow a written restore plan and test it by restoring a real backup into a separate project and comparing it with production. The last test, on October 29, 2026, matched production, apart from changes made after the backup was taken. We repeat it at least every 6 months.
When you delete something, it leaves our live database at once and is gone from every backup within 7 days.

How we build and watch the app

Every code change goes through a pull request with automated checks before it ships: a type check, a scan for leaked secrets, a scan of every dependency for known vulnerabilities, and an automated code review.
A strict Content Security Policy means browsers run only our own code on newsbooklm.com, plus the analytics and advertising tags you choose to allow. Article text and AI output are cleaned before display, and web addresses you give us are checked before our servers fetch them. Every request to an AI feature is size-checked on our servers before it reaches a model. When something goes wrong you see a plain message; the technical details go only to our error monitoring.
Errors are reported to us automatically and checked twice a day. Every 3 hours we check for bursts of failed sign-ins, wrong two-step codes and refused requests, and any burst raises an alert for us. A weekly check confirms from outside that our security headers, encryption settings and data isolation are still in place.

Your data, your control

In Settings, Export My Data downloads everything stored with your account, and Delete Account removes it and cancels any subscription at once. The Privacy Policy lists how long each kind of data is kept.

Subprocessors

The companies that process data for us, what each one receives and where, are listed in Section 6 of our Privacy Policy. We update that list before any new provider receives your content.

If something goes wrong

If we confirm a security incident that affects your data, we will email the affected account owners without undue delay, and no later than 72 hours after confirming it. The email will say what happened, what data was involved, what we are doing about it and what you can do. We will also notify regulators where the law requires it.

Reporting a vulnerability

Found a security problem? Email security@newsbooklm.com with the steps to reproduce it. We reply within 3 business days and keep you updated until it is fixed. Our contact details are also at /.well-known/security.txt.

Please test only against your own account, never access or change other people's data, and don't run denial-of-service or high-volume automated scans. We will not pursue legal action against research done in good faith within these rules, and we ask that you give us reasonable time to fix a problem before you share it publicly.

Contact

Security questions, questionnaires and vulnerability reports: security@newsbooklm.com. Everything else: support@newsbooklm.com.

Security at NewsbookLM