Security

Multi-tenant isolation

Every tenant table in our database enforces row-level security (RLS) keyed to your organization. Queries are scoped to your workspace at the database layer, so one tenant’s data is never reachable from another’s session. Privileged service credentials are used only for narrowly-scoped server operations and never leave our backend.

Encryption

Data is encrypted in transit using TLS and encrypted at rest by our infrastructure providers. Secrets and credentials are stored as environment configuration on the server and are never exposed to the browser.

Authentication

We use passwordless magic-link authentication, which eliminates the risk of stored or reused passwords. Access within a workspace is governed by role-based permissions, and Business-tier customers can enable SSO (Google / Okta).

Payments

Billing and card processing are handled entirely by Stripe, a PCI-DSS Level 1 certified provider. We never receive or store full card numbers.

Auditing and monitoring

Sensitive actions are recorded in a per-organization audit log, and AI generations are metered with telemetry (model, token counts, credits). Incoming webhooks are signature-verified before they are processed.

Data hosting and subprocessors

We run on established infrastructure providers — Supabase (database and authentication), Vercel (application hosting), Stripe (payments), and Anthropic (Claude models for generation). A full list is maintained in our Privacy Policy.

Compliance

We operate with SOC 2-aligned controls — least-privilege access, audit logging, signed webhooks, and scoped credentials. We are working toward SOC 2 Type II and are not yet certified; we will update this page when our report is available. Business-tier customers can request our current security documentation and a Data Processing Addendum (DPA).

Reporting a vulnerability

If you believe you’ve found a security issue, please email security@aitoolbuilder.app. We investigate all reports and appreciate responsible disclosure.