Security
Secureby design.
Your code, data, and ideas are protected at every layer. From encrypted storage to sandboxed environments, security is built into the foundation, not bolted on.
How we protect your data.
Security is not an afterthought. It is woven into every layer of the platform.
Encrypted by default
All data is encrypted in transit via TLS 1.2+ and at rest using AES-256. Database connections use SSL, and secrets are never stored in plaintext.
Secure data storage
Your project data lives in isolated Supabase PostgreSQL databases with row-level security policies. We enforce strict access controls at every layer.
Authentication & access
Powered by Supabase Auth with support for email/password, magic links, and OAuth providers. Sessions are short-lived with secure token rotation.
No training on your data
Your prompts, code, and project data are never used to train AI models. We contractually restrict all third-party AI providers from using your data for training.
Isolated environments
Each project runs in its own sandboxed environment. Cross-project data access is impossible by design, with strict logical separation between workspaces.
Continuous monitoring
Automated rate limiting, abuse detection, and real-time platform monitoring protect against misuse. We track anomalous patterns and respond proactively.
Compliance & standards.
We are working toward industry-standard certifications as we prepare for launch.
Security practices.
Beyond architecture, these are the ongoing practices that keep the platform secure.
Vulnerability management
Dependencies are continuously scanned for known vulnerabilities. Critical patches are applied promptly, and we maintain a responsible disclosure process.
Infrastructure security
Our infrastructure runs on hardened cloud platforms with network isolation, web application firewalls, and adaptive rate limiting at IP and user levels.
Secure code generation
AI-generated code is scanned for common security issues before deployment. We check for injection vulnerabilities, insecure configurations, and dependency risks.
Incident response
We maintain a documented incident response plan with defined severity levels, escalation procedures, and post-incident review processes.
Frequently asked.
Common questions about how Startbase handles security and data privacy.
Have a security concern?
We take every report seriously. Reach out and our team will respond within 48 hours.