Is it Safe to Build an Application on Bubble.io?

Before we look at security, let’s first understand why we can build an application on Bubble.io.
Bubble.io is a no-code app development platform. You can use it to develop software and applications without coding. In other words, Bubble.io lets you build an application without knowing core programming languages.
If you choose a traditional app development platform, you have to hire people with different skill sets, like

• Backend Developers
• Frontend Developers
• Database Developers and so, on…

Bubble.io, however, combines a backend, a frontend, a database, third-party resources, and several tools on one platform. We can describe Bubble as “a visual programming platform, where you can drag and drop elements to build the UI and create a workflow and database to build your app”. For more on Bubble, visit the Bubble website.

Is It Safe to Build an Application on Bubble.io?

When we build an application on any platform, our first concern is “Is my application and data secure?” or “Is the chosen platform reliable?”

Bubble’s official documentation explains:

Bubble protects your developed app and data using industry best practices. All apps produced on the Bubble.io platform benefit from the Bubble’s security investment.

Below is a list of the areas where Bubble provides security when you build an application on Bubble.io:

• Hosted on secure cloud ( Amazon Web Services )
• Monitoring and Testing
• Data Loss Recovery
• Server Logs
• RDS AES-256 encryption
• User-defined privacy

Amazon Web Services Behind Your Application on Bubble

As Bubble explains, “Bubble is using web services of the AWS during application development”. Therefore, AWS web services comply with certifications like SOC 2, CSA, ISO 27001, and more.

• Service Organization Controls 2 (SOC 2):  The American Institute of CPAs (AICPA) developed SOC 2. It is the compliance standard for service organizations. Its main purpose is to specify how organizations should manage customer data.

• Compliance, Safety, Accountability (CSA): Compliance, Safety, Accountability (CSA) compliance is defined by the Federal Motor Carrier Safety Administration (FMCSA). 
• ISO 27001: ISO 27001 is the international standard for information security. The main reason for this compliance is that it helps you avoid security-related threats. It sets out the specification for stopping cybercriminals from breaking into your organization.

Monitoring & Testing

Bubble itself uses automated code testing, vulnerability testing (including OWASP Top 10), and tools for continuous monitoring of the app code. Then, OWASP stands for “Open Web Application Security Project”. It is a nonprofit organization that works in web application security. The OWASP Top 10 is a list of the 10 most critical web application security risks. For example, the OWASP Top 10 2017 report lists these security risks:

• Injection
• Broken Authentication
• Sensitive Data Exposure
• XML External Entities (XEE)
• Broken Access Control
• Security Misconfiguration
• Cross-Site Scripting
• Insecure Deserialization
• Using Components with Known Vulnerabilities
• Insufficient Logging and Monitoring

The Bubble.io itself uses automated code testing, vulnerability testing (including OWASP Top 10), and tools for continuous monitoring of the app code. OWASP stands for “Open Web Application Security Project”. It is a nonprofit organization that works in web application security. The OWASP Top 10 is a list of the 10 most critical web application security risks. Below are the security risks listed in the OWASP Top 10 2017 report:

• Injection
• Broken Authentication
• Sensitive Data Exposure
• XML External Entities (XEE)
• Broken Access Control
• Security Misconfiguration
• Cross-Site Scripting
• Insecure Deserialization
• Using Components with Known Vulnerabilities
• Insufficient Logging and Monitoring

Data Loss Recovery

Bubble ensures that if a user deletes important application data by accident, they can recover it. How far back in time you can go depends on your active plan.

To copy and restore the database, first switch to the App Data section of the Data tab. Then click the Copy and restore database link.

After you click Copy and restore database, the popup below opens. In this popup you can copy and restore the database.

Your Bubble.io apps can access point-in-time data recovery for your own application data at any time. You can restore your application data to a previous point in time or copy the application data across versions.

Server Logs

Bubble apps also keep extensive logs of data changes and application functions. So, you can check at any time what someone did in your app. Also, Bubble creates logs in the background, so you can see what is going on in your app. The server logs help you explore past issues in your application.

In the Server Logs section of the Logs tab, you can search the log of server-side actions. You can also search for a particular user ID or name, specific dates, or specific keywords.

RDS AES-256 Encryption

Bubble uses AWS RDS’s AES-256 encryption to encrypt data. RDS stands for “Amazon Relational Database Service.” Amazon RDS encrypts DB instances with an industry-standard AES-256 encryption algorithm on the server that hosts them. After the encryption, Amazon RDS handles authorization of access and decryption of your data transparently. As a result, you don’t need to apply encryption to your application database yourself.

User-Defined Privacy

In Bubble, we can protect our app’s data at the application level using user-defined privacy rules. It is a restriction that you apply to your Bubble app’s data to control who has access to it. Privacy rules keep database records out of search results. They also control which users can view and update all or specific fields and file attachments.

In the Privacy section of the Data tab, you can define a new rule for the selected Data type. To define a new rule, click the define a new rule button.

A define a new rule popup opens. Then fill in the rule name and click the CREATE button.

Now write a condition on the “when element” and give permissions to the users who match the rule. Also, you can give default permissions to users who do not match the rule.

Conclusion

Bubble.io is a great choice for rapid web and mobile development projects. It takes care of the complexity of managing infrastructure, data, and security, so you can focus on solving your business challenge. In short, it is safe to build an application on Bubble.io.

We are a team of professionals with cross-domain experience and knowledge for building custom no-code apps in a secure and scalable way

.