Skip to content

Your data. Your rules. Your approvals.

Your business information is confidential. Here is exactly what we do to protect it, and what we have not done yet.

Your data

  • Uploaded files go to private storage. They have no public address and are never shown to anyone else.
  • Files are checked before they are stored: the extension, the declared type and the real file contents must agree, and size is limited to 5 MB.
  • Your blueprint is reachable only through a long, random private link. It is not indexed by search engines.
  • Secrets and keys live in server settings, never in the site code or your browser.
  • When AI drafting is switched on, your answers are sent to the configured AI model provider only to write your blueprint.

The site

  • Everything is served over HTTPS with strict transport security.
  • We send a content security policy and the standard browser protection headers.
  • Every form is validated on the server, not just in your browser. Forms use spam traps and rate limits.
  • Website reading in the builder only fetches the one public page you point us at, respects robots.txt and refuses private network addresses.
  • Payments are handled by Stripe. Card details never touch our servers.

Your employee

  • Approval comes first. Anything that leaves your company, touches money or changes a customer record waits for a person unless you decide otherwise.
  • Rules are written down before anything runs: what it may do alone, what needs approval and what it must never do.
  • Tools are connected one at a time with your permission, starting read-only, and you can revoke access from the tool at any time.

What we have not done yet

  • We have not completed an independent security audit or a certification such as SOC 2.
  • Stored data is deleted on request, not automatically on a timer.
  • Rate limiting is best-effort in the application. Edge-level limits are configured separately.

Report a problem

If you think you have found a security issue, please tell us through the contact form with the word security in your message. Do not include sensitive data.

Build my AI employee