Security Statement

This page describes the security practices actually in place for getbuilo.com. It is a description of our own controls, not an audit, certification, or a promise that no incident can occur.

Accounts and access

• Sign-in is email and password or Google sign-in, handled by our authentication provider. We never see or store your password.
• Every project, report, quiz answer, purchase record and progress row is tied to your account and protected by row-level database rules, so one account cannot read another account's data.
• Administrative functions (the skill library) are restricted server-side by a role check. A signed-in user without the admin role is refused, regardless of what the interface shows.
• Payment card details are entered directly with Stripe and never reach our servers.

How data is handled in transit and at rest

• The site and all API calls are served over HTTPS.
• Database and authentication run on managed infrastructure with encryption at rest provided by the platform.
• Sensitive service credentials are held as server-side secrets and are never shipped to the browser.

Website analysis safety

When you ask us to analyse a website, the fetch happens on our servers and is limited to http and https addresses on standard ports. We block localhost, loopback, private, link-local and cloud-metadata addresses, re-check every redirect hop, cap the response size, time the request out, and never send cookies, credentials or run JavaScript. We do not authenticate to anything on your behalf. These are meaningful protections, not a guarantee: our runtime cannot resolve DNS before fetching, so a public hostname that deliberately points at a private address is not detectable in advance. Only submit URLs you are authorised to analyse.

Payments and webhooks

Stripe webhook events are signature-verified before processing and recorded so the same event cannot be applied twice. Credit grants, reservations and refunds are written through database functions that keep balances consistent.

What we do not claim

• We are not SOC 2, ISO 27001, PCI, HIPAA or GDPR certified, and this page is not an independent verification.
• We do not offer end-to-end encryption; our systems can technically read the content you store in order to generate results.
• We cannot guarantee that the service is free of vulnerabilities or that no incident will ever occur.
• We have not commissioned a formal penetration test or third-party security assessment, and we do not run a paid bug bounty.
• Beyond the protections our hosting and authentication providers apply, we do not operate application-level rate limiting, intrusion detection, or a documented, rehearsed incident-response plan.
• We rely on our providers' managed backups; we do not operate or test an independent backup and restore process of our own.

Reporting a vulnerability

Email support@getbuilo.com with steps to reproduce. Please test only against your own account, avoid accessing other people's data, and give us a reasonable window to fix the issue before disclosing it. We do not currently run a paid bug bounty.

If something goes wrong

If we become aware of a breach affecting your personal data, we will notify affected account holders by email at the address on the account, without undue delay and within any period applicable law requires, and describe what happened and what to do about it. We are a small operation, so we have not committed to a fixed notification deadline beyond what the law imposes.

Related pages

See our privacy policy, acceptable use policy and terms.