Security

Every tenant-scoped table is protected by row-level security, so a query that forgets its scope still cannot return another organization’s rows. We test this deliberately, by issuing unscoped queries against seeded data and asserting the database refuses them.

Tokens and API keys are encrypted at rest, and are masked in the interface once saved. Logs redact known secret fields by name; this is a best effort and not a guarantee that no secret can appear in a log.

Traffic to Buildly and to sites built with it is served over HTTPS. Browser security headers such as HSTS and a Content Security Policy are being rolled out and are not yet in place on every part of the platform.

The staff console sits on its own hostname behind an identity gate at the network edge. The application’s own independent re-check of that gate is not finished yet, and multi-factor authentication is available but not yet required for every staff role.

Staff roles that can open an organization can read the business brief, the interview transcript and site drafts for support purposes; see the Privacy Policy. We do not yet offer consent-based, time-boxed access.

If you believe you have found a security issue, contact security@buildly.io before disclosing it publicly. We will confirm receipt and keep you updated while we investigate.