Security and privacy

2.Encryption

Kurz gesagt: encrypted in transit and at rest.

All traffic to chatbuild.com, your dashboard and the sites we host runs over TLS (https). Data in the database and in object storage is stored encrypted. Sites we publish automatically get a valid certificate — nothing for you to do.

3.Access control and MFA

Kurz gesagt: as few people as possible, with two-step verification.

Internal access to production systems is limited to the people who really need it (least privilege) and always sits behind multi-factor authentication. Rights are granted per role and revoked as soon as someone no longer needs them. Support does not look into your data uninvited; only when needed to solve a problem, and that is logged.

4.Logging and monitoring

Kurz gesagt: we keep track of what happens, so we spot errors and abuse quickly.

We log system events, errors and data access, and monitor for unusual patterns. Logs have restricted access and are not used for anything other than security, troubleshooting and quality. Retention periods are in the privacy policy.

5.Backups and recovery

Kurz gesagt: we make backups and test whether we can restore them.

We make regular encrypted backups of the database. Our recovery objectives: at most 24 hours of data loss (RPO) and a recovery time of at most 24 hours (RTO). We test restores periodically — a backup you've never restored is not a backup.

6.Separation of customer environments

Kurz gesagt: your data and other customers' data stay strictly separated.

Customer data is logically separated: every request is bound to one customer context, and the database enforces that data can only be retrieved within its own environment. The generated sites are separate from each other too, each on its own domain.

7.Security scan at publication

Kurz gesagt: before a site goes live, we check it for unsafe content.

At publication we automatically check for signs of phishing and malware, and for links to known harmful domains. If the check trips, the site does not go live and we contact you.

8.Prompt injection and AI misuse

Kurz gesagt: the AI may only work on your site — not on someone else's.

Because our AI works with your messages and supplied content, we take specific measures:

• the AI operates within strict boundaries: only on its own customer environment, with limited rights;
• content coming from messages and uploads is treated as untrusted input, not as instructions;
• sensitive actions (such as publishing or connecting a domain) require your explicit confirmation;
• rate limits and abuse detection on messages and AI edits;
• we don't train models on your data, unless you choose to allow it — see the privacy policy.

9.Incident procedure

Kurz gesagt: if something goes wrong, you hear it from us — fast and without weasel words.

We have a fixed procedure: identify and contain, investigate what happened, recover, and inform. If it concerns personal data we process for you, we notify you without unreasonable delay and at the latest within 24 hours, with the information you need for a possible notification to the supervisory authority. The arrangements are in article 9 of the data processing agreement. Afterwards we record what we change to prevent repetition.

10.Staff and confidentiality

Kurz gesagt: everyone at our end is bound to confidentiality and knows how we handle data.

Employees and engaged specialists are contractually bound to confidentiality and only get access to what their work requires. They are instructed on working securely and handling personal data. When someone leaves, we revoke access immediately.

11.Testing and pentests

Kurz gesagt: we have our security tested periodically, at cadence yearly and before major changes.

In addition to automated checks on dependencies and configuration, we have penetration tests performed at a cadence of yearly and before major changes. Findings are addressed by risk. As a business customer you can request a summary of the latest test via security@chatbuild.com.

12.Responsible disclosure

Kurz gesagt: found a vulnerability? Report it — and we take no legal action against you.

Report a vulnerability to security@chatbuild.com with enough detail to reproduce it. What you can expect from us:

• we confirm your report within 5 working days;
• we keep you informed of the fix;
• at your request we credit you as the finder once the issue is resolved;
• we take no legal action against reporters who act in good faith and stick to the rules below.

What we ask of you: don't view, change or download other people's data, don't disrupt any service (no DDoS, spam or brute force), no social engineering or physical break-ins, don't share a vulnerability with third parties before it's fixed, and don't leave backdoors. We offer no monetary reward, unless stated otherwise on no reward programme.

13.What we do not (yet) claim