Skip to content
Sign in Sign up

Security

Last updated: 14 October 2026

This page describes how we protect your account and your data today. It lists only measures that are in place. We do not hold security certifications such as ISO 27001 or SOC 2. For a security questionnaire, write to [email protected].

1. Where your data lives

  • The app, the API and our databases run on Microsoft Azure in the Poland Central region, in the EU. Account and workspace data is stored there.
  • Microsoft Azure encrypts the disks that hold our databases.
  • The database with accounts, workspaces, API keys and billing records is copied every day to separate storage in the same Azure region, encrypted at rest. Only our administrators can read the copies.
  • Cloudflare provides DNS and the network in front of baseray.ai, app.baseray.ai and api.baseray.ai, and hosts baseray.ai.
  • The companies that process personal data for us are on our sub-processors page.

2. Encryption in transit

Every connection to baseray.ai, app.baseray.ai and api.baseray.ai uses HTTPS. Requests over plain HTTP are redirected to HTTPS.

3. Signing in

  • Passwords are stored only as bcrypt hashes; we cannot read them. A password needs at least 8 characters.
  • Two-factor authentication with an authenticator app is available for every account, with recovery codes. The secret behind it is stored encrypted.
  • Sign-in and two-factor attempts are limited to 5 per minute. Password reset links expire after 60 minutes.
  • A session ends after 120 minutes without activity, unless you choose to stay signed in on that device.
  • In Settings you can see your sessions, with their IP address, browser and last activity, and sign out every other device. Changing your password also signs out your other sessions and revokes access tokens.
  • Session cookies are sent only over HTTPS and cannot be read by scripts on the page. Our cookie notice lists them.

4. Workspaces and roles

  • Every request to workspace data is checked against the workspace’s members and their roles.
  • Only the owner and administrators can invite or remove members, change roles, change workspace settings and manage billing. Among the members, only the owner can delete the workspace.
  • Access to our internal admin panel is limited to a short list of named staff accounts with verified email addresses.

5. API keys

  • An API key is shown once, when it is created. We store only its SHA-256 hash, so we cannot show it again.
  • A key can expire after 30, 90 or 365 days, or never. Its creator, the workspace owner or an administrator can revoke it at any time, and it stops working when its creator leaves the workspace.
  • Each key may make 60 requests per minute, and each workspace 5,000 requests per day.
  • Every member of the workspace can see the log of requests made with its keys: time, path, status, IP address and browser. The key itself is never logged. The log keeps each request for 30 days.

6. AI assistants connected through MCP

  • Assistants connect through OAuth 2.1 with PKCE, after you sign in and approve the connection for one workspace.
  • Access tokens expire after one hour. Refresh tokens change on every use; if an old one is used again, the connection is closed.
  • We store tokens only as SHA-256 hashes, and tokens work only for our MCP server.
  • Your membership of the workspace is checked again on every call. A connection may make 60 calls per minute and 2,000 per day.
  • You can disconnect an assistant at any time in Settings → Connected apps; its access stops at once.

7. Payments

Checkout and the billing portal run on Stripe’s own pages. Card details go to Stripe directly and never reach our servers.

8. Deleting data

  • Deleting your account in Settings removes it at once: your sessions, tokens, API keys you created, connected assistants, memberships and saved buildings. It needs your password.
  • Deleting a workspace removes its lists, saved buildings, API keys, connected assistants and billing records at once; invoices stay with Stripe. Among the members, only the owner can do it.
  • Deleted data stays in our database backups until those copies are deleted automatically, at most 7 months later.

9. How we run the service

Passwords, keys and other configuration secrets of our systems are kept in a secrets manager, not in the code.

10. Reporting a vulnerability

If you find a security problem, write to [email protected] with “Security” in the subject, the steps to reproduce it and its likely impact. Please do not access or change data that is not yours, do not disrupt the service, and give us reasonable time to fix the problem before you disclose it. We read every report and reply to you.

11. If something goes wrong

If a personal data breach affects your data, we notify the supervisory authority and you as the law and our data processing addendum require.