Snapshot 210807
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Base44 Search the Trust Center... Ctrl +K Quick links Website URL Security Page Product Documentation Quick links Website URL Security Page Product Documentation Quick Summary One or more annual third-party audit(s) Annual third-party penetration testing Has a disaster recovery plan Subprocessors list available Has cyber insurance Will enter into a DPA Has a bug bounty or vulnerability disclosure program Deletes customer data on request Has an API available Uses a centralized IAM solution (SSO) to manage employee access Has a status page Has a privacy policy Has an AI policy Badges Sep 9, 2026, 12:55 UTC Incident Response A dedicated Security Incident Response Team operates under a formal Incident Response Plan and Security Incident Management Policy, ensuring security events are identified, contained, and resolved quickly. Sep 9, 2026, 12:55 UTC 24/7 Security Monitoring Our platform is monitored around the clock by a 24/7/365 Security Operations Center (SOC), powered by SIEM technology and supported by a dedicated security team. Sep 9, 2026, 12:55 UTC Disaster Recovery & Business Continuity We maintain defined Recovery Time and Recovery Point Objectives aligned with industry standards, backed by frequent automated backups and documented recovery procedures. Detailed commitments are available to Enterprise customers as part of their Service Level Agreement. Sep 9, 2026, 12:55 UTC Bug bounty program Independent security researchers probe our systems and disclose what they find – responsibly. Our security team reviews and validates every submission, prioritizes confirmed vulnerabilities by severity and fixes them. Request a Bug Bounty Invite Sep 9, 2026, 12:55 UTC Third-party risk management We assess every vendor against defined security and compliance requirements, and re-validate periodically. See the vendors that handle your data in the subprocessor directory below. Sep 9, 2026, 12:55 UTC Secure payments & anti-fraud Payments run through PCI DSS-certified providers. Base44 encrypts sensitive payment data in transit and never stores it, and a layered anti-fraud system combines specialized fraud-detection providers with Base44's own detection. Sep 9, 2026, 12:55 UTC Encryption & key management Base44 encrypts your app data in transit with TLS 1.2+ and at rest with AES-256, and manages secrets in a cloud key management service (KMS). Encryption covers backups too. HTTPS enforced on every domain, certificates issued and renewed automatically An additional encryption layer on secrets and credentials Automatic encryption key rotation Sep 9, 2026, 12:55 UTC Penetration testing Internal teams and third-party firms test our defenses against real-world attack scenarios, based on OWASP methodologies. Our security team reviews, prioritizes and tracks every finding to resolution. Sep 9, 2026, 12:55 UTC Secure development life-cycle Security runs through every stage of building Base44 – threat modeling, secure design, code reviews and penetration testing, so risks surface early and get fixed early. Documents & Knowledge Base FAQs Subprocessors32 Subprocessor Location of Processing Usage Details Anthropic United States API calls to LLM AWS United States Cloud storage, infrastructure services and API calls to LLM Baseten United States API calls to LLM Black Forest Labs Germany Image generation services Browserbase United States Cloud browser automation services BytePlus Singapore Image generation services ClickHouse United States Analytics event storage Cloudflare United States Edge delivery and hosting of published applications Crusoe United States API calls to LLM Datadog United States General logging purposes Decart Israel API calls to LLM Deno United States Execution of application backend functions E ElevenLabs United States Speech generation services Expo United States Mobile push notification delivery Firecrawl United States Web scraping and content extraction Fireworks AI United States API calls to LLM Gemini United States API calls to LLM Google Cloud United States Analytics services Modal United States Sandbox compute and runtime services MongoDB United States Data storage and hosting Nebius Netherlands API calls to LLM OpenAI United States API calls to LLM Parallel.ai United States Web search and grounding services Pydantic Logfire United Kingdom General logging purposes Render United States Server services SendGrid United States Email transmission and external communication SerpAPI United States Web search services stripe.com United States Payment processing for in-app transactions Supabase United States Media hosting Temporal Technologies Inc United States Workflow orchestration and execution Twilio United States Voice and SMS communication services xAI United States API calls to LLM Last updated November 4, 2026. . View as: Powered by Conveyor, the first end-to-end customer trust platform. Learn more