Security and your data
======================

A plain-language look at how SuperSchema handles your sign-in, your connected services like HubSpot, and your payment details, and what happens to your data when you disconnect or delete.

Category: Account & Settings | Last updated: 2026-07-07

SuperSchema is built to keep the sensitive parts of your account (your sign-in, your connected services, and your payment details) with specialist providers rather than holding them in the open. This page explains, in plain language, how each piece is handled.

YOUR SIGN-IN AND PASSWORD

Signing in is handled by our authentication provider (Clerk). Your password and login are managed on their platform, which specializes in secure authentication, rather than being stored by SuperSchema directly. If you sign in with a social login, that provider handles the login and SuperSchema only receives confirmation of who you are.

CONNECTED SERVICES LIKE HUBSPOT

When you connect a service such as HubSpot, SuperSchema stores an authorization token so it can act on your behalf. Those tokens are encrypted before they are saved, using strong, industry-standard encryption (AES-256-GCM). They are not kept as plain readable text.

- A connection only grants the access you approve when you authorize it.
- You can disconnect a service at any time from Settings > Integrations.
- When you disconnect, the stored token for that connection is removed so it can no longer be used.

PAYMENTS AND CARD DETAILS

Payments are processed by Stripe, a dedicated payments provider. SuperSchema does not store your full card number. Your card details are handled by Stripe, and SuperSchema works with the reference and billing information Stripe returns rather than the raw card data.

SCANNING AND READING YOUR SITE

A site scan only reads your public pages, the way a search engine or AI crawler would. It is read-only: it does not sign in to your site, change your content, or alter your settings. Our crawler identifies itself so you can recognize and allow it.

WHEN YOU DISCONNECT OR DELETE

- Disconnecting an integration removes the stored token for that connection.
- Deleting your account removes your account data and any stored connection tokens, cancels active subscriptions, and deletes your sign-in account. See deleting your account for the full list of what is removed.

Tip: Have a specific security or privacy question that is not answered here? Reach out through Support and the team will help.

QUESTIONS THIS ANSWERS

- Is my data safe with SuperSchema?
- How is my password stored?
- Is my HubSpot connection secure?
- Do you store my full credit card number?
- What happens to a connection when I disconnect it?
- Does scanning my site change or expose anything?
- Who handles payments?
- I have a specific security question, who do I ask?