Skip to content

Security

Last updated: September 10, 2026

Your Data Is Yours Alone

Every customer site and AI agent runs in its own isolated environment. Your data is never mixed with another customer's. Agent conversations stay between you and your agent — we don't train on them, share them, or sell them.

Encryption at Rest & in Transit

  • TLS 1.3 encrypts all data moving between your browser, our API, and our hosting providers.
  • Encrypted storage for sensitive fields — API keys, bot tokens, and credentials are encrypted at rest using AES-256 and decrypted only when needed.
  • LUKS disk encryption on all agent hosting servers — even if physical hardware is compromised, data on disk is unreadable.

Zero-Data-Retainment AI Routing

AI model requests for your agent are routed through OpenRouter with zero-data-retainment (ZDR) providers enabled. This means:

  • The AI provider does not store your prompts or responses after processing.
  • Conversations are not used for training AI models.
  • We select model providers that contractually guarantee ZDR — currently DeepSeek V4 Flash (primary) and Gemini 2.5 Flash (fallback).
  • If you provide your own API key (BYOK plan), you control the provider relationship and their data policies apply.

Infrastructure Security

  • Managed hosting — websites on Vercel, agent hosting on dedicated VPS instances with LUKS encryption.
  • Rate limiting on all public-facing API endpoints to prevent abuse.
  • Cloudflare Turnstile CAPTCHA on forms to block automated submissions.
  • Bearer token authentication for admin and webhook endpoints — no public admin surfaces.
  • fail2ban on all VPS instances to automatically block brute-force SSH attempts.
  • Minimal attack surface — no customer-facing admin panels, no direct database access, no shell access provided to customers.

Data Handling & Retention

  • No data selling — we never sell your personal information or business data.
  • Agent conversations are not stored — we track usage counts (message volume) but do not retain conversation content.
  • Full deletion on cancellation — when you cancel, your agent is decommissioned and all data on the hosting infrastructure is permanently deleted.
  • Demo site data expires after 30 days (archived) and is permanently deleted after 90 days.
  • Audit logging — all admin actions on your account are logged with timestamps for accountability.

Payment Security

All payment processing is handled by Stripe. Credit card numbers never touch our servers. Stripe is PCI DSS Level 1 certified — the highest security standard in the payments industry.

Authentication & Access Control

  • Clerk handles authentication — secure session management, MFA support, and password policies.
  • Role-based access — customer accounts can only access their own data and sites.
  • API keys are encrypted at rest and never exposed in the dashboard or API responses (masked with “sk-...xxxx” format).
  • Telegram bot tokens are stored encrypted and used only for configuring your agent — never shared with third parties.

Incident Response & Reporting

If you discover a security vulnerability or suspect unauthorized access:

We investigate all reports promptly and will notify affected customers if a breach occurs.

Ongoing Improvements

Security is not a one-time checklist. We regularly review our infrastructure, update dependencies, rotate secrets, and improve our practices. As we grow, we plan to pursue formal security assessments and compliance certifications to give our customers even more confidence.

Privacy Policy →Terms of Service →