Data Security Statement

The BuiltAI platform runs on managed cloud infrastructure with encryption in transit (TLS) and at rest. Files are stored in a private bucket with access mediated by signed URLs and role-based checks.

• Authentication via Supabase Auth with strong passwords and support for magic-link sign-in.
• Role-based authorisation: BuiltAI Admin, Commercial Lead, Delivery Lead, QA Lead, Client Sponsor, Contributor and Reviewer.
• Client users only ever see their own client account, engagement, tasks and deliverables.
• Service-role access is restricted to trusted server operations and is audit-logged.

• Green: low sensitivity, standard handling.
• Amber: commercial / operational data, controlled handling and source-backed review.
• Red: personal, security-sensitive or regulated data - blocked in the MVP. Handled separately under a written secure-route agreement.

Major actions - uploads, downloads, QA decisions, approvals, SOWs, AI usage and admin overrides - are recorded in a system audit log with timestamp, actor, target and payload.

We rely on a small set of vetted sub-processors, each bound by a data processing agreement:

• Supabase - database, authentication and file storage. Applicable hosting and processing locations are documented in the service terms.
• Vercel - application hosting and delivery.
• Anthropic - the AI model provider behind our assisted workflows.
• Resend - transactional email.
• Cal.com - online booking calendar for calls. Processed in the United States under Standard Contractual Clauses or the EU-US Data Privacy Framework.
• Sentry - error and performance monitoring.
• Plausible - privacy-focused, cookieless web analytics.

Hosting and processing locations are documented in the applicable service terms. Some providers process data outside the UK; where they do, the transfer is protected by appropriate safeguards (UK adequacy regulations, the UK extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement). We give clients advance notice of any material change to this list.

In the event of a security incident affecting client data, we will notify the affected client without undue delay and provide the information necessary to fulfil any disclosure obligations.