Security
Built to be operated by an agent. Secured like it.
On AgentBuild, an AI acts on your behalf. That makes security a design input, not a checklist: every action is authenticated, validated, and gated before it can touch a live site. This page states what is actually implemented today, nothing more.
How the platform protects you
Every customer site is isolated
Each site gets its own database. Site content and contact-form submissions are never stored in a shared database, and every management request that reads or changes a site is checked against the account that owns it. Public visitor endpoints, like submitting a contact form, are protected separately with anti-abuse verification and rate limiting. Uploaded assets are stored under keys scoped to the site they belong to.
Published sites are static
Your site ships as prebuilt static pages served from a global edge network. There is no server-side application code running on your website, no database queries in the request path, and no admin login on your domain for an attacker to find. Most of the attack surface a typical website carries simply is not there.
Content is validated and sanitized
Your agent works through typed content tools, and everything is validated when it is written and sanitized when it is rendered: text is HTML-escaped, links are checked against unsafe URL schemes, and embeds are limited to verified providers. Photos are stripped of embedded metadata, including GPS location, before storage.
Nothing goes live without your say
Agents work on a preview site. Publishing to your real domain is a separate, gated step that requires the preview to be current, and sensitive actions record the explicit confirmation you gave before they run. You approve outcomes; the platform enforces the gate.
Credentials are hashed, cards are never held
API keys are stored only as SHA-256 hashes; the plain key is shown once at creation and never persisted. Passwords are stored as salted hashes. Payment card data is handled entirely by Stripe, a PCI DSS Level 1 provider; our own systems store no card details at all, only a reference to your Stripe customer record.
Data is encrypted and access is limited
Data is encrypted in transit with TLS and at rest in our primary databases. Platform tables carry row-level security policies. AgentBuild personnel access customer data only when needed for support, debugging, or security, and that access is logged.
Privacy is part of the design
- Our built-in analytics are cookieless, on our site and on yours. No analytics cookies, no fingerprinting, no cross-site identifiers, and on your published site a visitor's IP address is never stored with their visit record. If you choose to add a third-party tracker such as Google Analytics, that is your decision, and your agent is told when a provider sets cookies.
- Do Not Track and Global Privacy Control signals are honored by the built-in analytics on customer sites.
- We do not sell personal data, and we do not use your content to train AI models.
- Data retention is published, per category, in the privacy policy.
- If a breach affects you, we notify affected customers and authorities within 72 hours where required.
The full detail lives in the privacy policy and the subprocessor list, which states what data each listed provider processes and where.
Compliance, stated honestly
AgentBuild operates a GDPR-shaped privacy program: a data processing agreement with Standard Contractual Clauses is part of our customer terms, our privacy policy covers GDPR, UK GDPR, and CCPA/CPRA rights, and we give active customers 30 days’ notice before subprocessor changes. We do not yet hold SOC 2 or ISO 27001 certifications; the FAQ below says exactly where we stand and why.
Common questions
- Is AgentBuild SOC 2 or ISO 27001 certified?
- Not yet. We are an early-stage company and we say so plainly rather than implying otherwise. What we publish instead is specific: the security properties on this page, a GDPR data processing agreement in our terms, a public subprocessor list, and a privacy policy that states retention per category. We expect to pursue formal certification as the company and its customers grow.
- Who can see my site content and form submissions?
- You, the AI agent you authorize, and AgentBuild personnel when needed for support, debugging, or security (that access is logged). Each site's content and submissions live in that site's own database, and every request is checked against the owning account.
- What does my AI agent get access to?
- Only your sites and account, through an API key scoped to you, and only in response to requests you make. The privacy policy describes exactly what data the platform returns into your AI client. Your AI client, whether ChatGPT, Claude, or another you connect, is your chosen tool, and its own terms govern data inside it.
- Where is my data stored?
- Primary account data is stored in the United States, and site content is delivered from a global edge network. Transfers from the EEA, UK, and Switzerland rely on Standard Contractual Clauses. The subprocessor list states the processing region for every provider we use.
- Do you store my payment card?
- No. Card data is handled by Stripe, a PCI DSS Level 1 payment provider. AgentBuild's own systems store no card details, only a reference to your Stripe customer record.
Found a vulnerability?
We appreciate good-faith security research. Email security@agentbuild.it with steps to reproduce and we will respond promptly. Machine readers can find this contact at /.well-known/security.txt.