Your data is protected
at every layer

All data is encrypted both in transit and at rest. There is no path for cleartext data to persist in our systems.

• All network traffic is protected with TLS 1.2 or higher — HTTPS is enforced globally with HSTS preloading.
• Data at rest in our PostgreSQL database is encrypted at the storage layer via AWS RDS encryption (AES-256).
• Integration credentials and third-party API keys are encrypted using AES-256-GCM with a versioned key ring, enabling zero-downtime key rotation without data loss.
• MFA secrets (TOTP) are encrypted before being written to the database using the same key ring.
• Passwords are stored as bcrypt hashes — plaintext passwords are never written to disk or logs.

Access to your data is controlled at multiple levels. We follow the principle of least privilege throughout.

• Every project runs in an isolated environment — your data is not shared with or accessible by other tenants.
• Role-based access control (RBAC) is enforced across all project and workspace resources.
• Sessions expire after 8 hours of inactivity. JWT tokens are signed and validated on every request.
• Brute-force protection is applied to all authentication endpoints: accounts are locked after 10 failed attempts for 15 minutes.
• Rate limiting is applied to login and registration endpoints to prevent credential stuffing attacks.
• All internal admin access is restricted to authenticated superadmin accounts with a separate credential scope.

MFA adds a second layer of identity verification to every login, protecting your account even if your password is compromised.

• Time-based one-time passwords (TOTP) compliant with RFC 6238 — compatible with any standard authenticator app (Google Authenticator, Authy, 1Password, etc.).
• One-time backup codes are generated at enrollment for account recovery.
• MFA can be enabled and managed from your account Security settings.
• Disabling MFA requires both your current password and a valid TOTP token.

Every sensitive action in your account generates an immutable audit event, giving you full visibility into who did what and when.

• Events recorded include: login success/failure, account lockout, MFA enrollment/disable/verify, password changes, role changes, settings changes, and API key rotations.
• Each event captures IP address, user-agent, timestamp, outcome (success/failure), and affected resource.
• Your personal audit log is accessible from Security settings.
• Platform-wide audit logs are available to superadmin operators with additional filtering by action, outcome, and user.

• Minimum 8 characters, requiring at least one uppercase letter, one lowercase letter, one number, and one special character.
• The last 5 used passwords cannot be reused, preventing password cycling attacks.
• Passwords are validated at registration and on every password change.

bldrAgent runs on AWS in a hardened, regionally distributed environment.

• Hosted on AWS with compute, database, and storage isolated inside a dedicated VPC.
• PostgreSQL databases run on Amazon RDS with automated backups, Multi-AZ failover, and encrypted storage.
• Static assets are served through Amazon CloudFront CDN with HTTPS enforcement.
• Security headers are set globally on every response: HSTS, X-Frame-Options, X-Content-Type-Options, Content Security Policy, Referrer-Policy, and Permissions-Policy.
• Infrastructure-as-code (AWS CDK) ensures configuration is version-controlled and auditable.

• Input validation and output encoding are applied throughout the application to prevent injection attacks.
• Content Security Policy blocks unauthorized script sources and inline execution.
• Dependencies are tracked and updated regularly to address known vulnerabilities.
• Sensitive values (secrets, keys, credentials) are never logged or exposed in error responses.
• All API endpoints enforce authentication. Privileged endpoints require elevated role checks.

• All user data is logically isolated by account — cross-tenant data access is not possible.
• Upon account deletion, personal data is purged within 30 days in accordance with our Privacy Policy.
• Backups are encrypted and access-controlled. Backup restoration requires operator authentication.

We take security incidents seriously and respond quickly to minimize impact.

• Security incidents are assessed, contained, and investigated by our engineering team.
• Affected customers are notified without undue delay if a breach of personal data occurs, in compliance with applicable law.
• A post-incident review is conducted after any significant event to identify root cause and improve controls.

If you discover a security vulnerability in bldrAgent, we ask that you disclose it to us responsibly before making it public. We review all reports and respond within 5 business days.

Report vulnerabilities to [email protected]. Please include steps to reproduce, potential impact, and any relevant screenshots or proof-of-concept. Do not access, modify, or exfiltrate data beyond what is needed to demonstrate the issue.