1. Where Your Data Lives
The application runs on Vercel, the database on Convex in the United States, and published sites and media on Cloudflare. The Subprocessors page lists everyone who may process your data.
- Stripe handles card details. We never store a card number.
- We keep API keys as hashes and encrypt connected-service credentials with AES-GCM before storing them.
- Form submissions from published sites are kept in the United States for 180 days, then deleted.
- Workspace activity is kept in an audit log for 365 days.
- You can turn on two-factor sign-in in your account settings.
2. Published Sites
Published sites run on their own domains, apart from the application, so a site cannot read a session on builder.studio.
3. AI Requests
We do not train AI models on your content. Requests we route through our AI gateway ask only for providers that do not train on them. With your own provider key, your account’s settings with that provider apply.
4. What We Do Not Have
We do not hold a SOC 2 report, have not had an outside penetration test, and do not offer single sign-on. If your review requires one of these, tell us before you commit.
5. Reporting a Vulnerability
Email security@builder.studio with the steps to reproduce it. Do not access, change, or disclose data that is not yours. We do not run a paid bounty.
6. Contact
For security questions, contact us at security@builder.studio.