What we actually do with your specs.

Uploaded artifacts and exports live in EU object storage; the application and its PostgreSQL database are hosted in Frankfurt. AI inference and payment processing are performed by providers that may operate in the United States — see the subprocessor list below.

By default a workspace holds specifications only, and there is nowhere to attach production records. A workspace owner can opt in to data extracts, which lets an editor attach one real export per integration. That file is parsed in memory and discarded in the same request — it is never written to object storage, never added to the text or chunk tables the AI reads from, and never sent to an AI provider. What persists is a per-column profile: how many records have a value, how many distinct values there are, and whether those values look like dates, numbers or text. Column values themselves are never stored. Turning the setting back off deletes those profiles. Protected health information, payment card data and government identifiers are not accepted.

Every workspace-scoped request resolves the signed-in user's membership before reading a row, and a request for something you're not a member of returns 404 rather than 403 — endpoints aren't existence oracles. Static guards in the test suite assert that every workspace route and page does this; a runtime two-tenant test proves it end to end.

Passwords are hashed with bcrypt and never stored in plain text; sessions are HTTP-only, Secure cookies. Sign-in is throttled on three independent windows — per IP, per email-and-IP pair, and per email — so credential stuffing is capped without letting an attacker lock a real user out of their own account. Over-limit is indistinguishable from a wrong password, so it can't be used to enumerate accounts. Password-reset links are single-use and expire in 30 minutes.

TLS everywhere, HSTS enabled, and an enforced security-header set: a strict Referrer-Policy, X-Content-Type-Options: nosniff, and X-Frame-Options: DENY. A Content-Security-Policy is also deployed, in report-only mode, while we watch real traffic for violations before enforcing it.

Artifacts are size-checked before they are read, and archive formats are screened for declared-size zip bombs. Files that can't be decoded are reported as unreadable rather than silently half-ingested.

Application errors are captured by an EU-hosted error monitor. The managed database is backed up by the hosting provider on its standard schedule.