Content is data, not instructions
Web pages, emails and data from your connected apps are read as data. Anything with a side effect still waits for you, so a message can't act on its own.
The security behind your Bits.
Your credentials never reach the AI, anything that acts for you waits for your approval, and your data never trains a model.
Encrypted in transit and at rest · Each app its own database · Built on audited infrastructure
Built on audited infrastructure.
Bitsbase runs on independently audited providers, so your data sits on SOC 2 and ISO 27001 audited infrastructure.
- VercelHosts bitsbase.com and every published appSOC 2 Type 2 · ISO 27001
- RailwayRuns the Bitsbase APISOC 2 Type II
- NeonRuns our databases and each app's ownAudited annually
- AI modelsRun through commercial APIsNo training on your data
What Bitsbase does, and doesn't.
Does
- Encrypts everythingTLS 1.2 or higher in transit. AES-256 at rest, and AES-256-GCM again for the secrets we store.
- Asks before actingIn chat, it shows what it will send, post or change, and waits for your approval.
- Gives each app its own databasePublishing is blocked unless every table has row-level security.
- Lets you disconnect anytimeOne click stops an integration and asks the provider to revoke access.
Does not
- Show your secrets to the AIThe AI sees which accounts are connected and the results, never the tokens.
- Train on your dataNeither Bitsbase nor the AI models we use train on it.
- Store a Bitsbase passwordYou sign in with Google or a one-time email link.
- Send prompts to tracing toolsIn production, prompts stay out of third-party AI tracing.
Your Bits use your accounts. Here is how they handle them.
- Task
- Summarize this week's invoices from Gmail
- Account
- Gmail (connected)
- OAuth token
- [never shown]
- App secret
- [named, never given]
Safe with the outside world.
The right model, no training
Each task runs on the model best suited to it, for quality and cost, through commercial APIs that don't train on the data we send them.
You stay in control
Disconnect any account, pause any routine, delete any chat, and download your app's code and data at any time. Account actions are kept in a log you can review.
Found a problem? Tell us.
Read how we handle reports, then send yours to our security team.
Questions.
Can the AI see my passwords or tokens?
No. Sign-ins to your tools are held by our OAuth provider, and the secrets Bitsbase stores are encrypted. The AI is told which accounts are connected and sees the results of what it did, never the tokens or secret values.
Is my data used to train AI models?
No. Bitsbase trains no models, and our AI runs through commercial APIs that do not train on the data we send them.
Does Bitsbase act without asking me?
In chat, never for anything that sends, posts or changes something: you see exactly what it will do and approve it. Apps and routines you set up get your approval once, when you connect them, and you can revoke it at any time. Reading your data does not ask each time.
What audits cover Bitsbase's infrastructure?
Bitsbase runs on providers that are independently audited: Vercel (SOC 2 Type 2 and ISO 27001), Railway (SOC 2 Type II) and Neon, whose databases are audited annually.
How do I report a security problem?
Email security@bitsbase.com. We acknowledge reports within 5 business days. The full policy is at /security/report, and a machine-readable contact is at /.well-known/security.txt.