How we handle your code, your prompts, and your deployments — written in plain English so you can make an informed decision before you ship real applications on Buildra.
Each project's code is kept in a private git repository that Buildra hosts on Fly.io, and a snapshot of the workspace is stored in object storage so a sleeping project can wake where it left off. You can download the source at any time, and you can connect a GitHub repository you own so every commit the agent makes is pushed there as well.
All traffic to buildra.dev and to generated deployments uses TLS 1.2 or later. HSTS is enabled with a two-year max-age and includeSubDomains. The domain is on the HSTS preload list.
Buildra's database and project storage run on Fly.io, whose volumes are created with encryption at rest enabled by default. Published apps and their databases run on Cloudflare.
Buildra uses premium AI models on every plan. Your prompts, your code and any images you attach are sent to our AI model provider, through its API, to generate the app. That provider states that it stores and processes data in the People's Republic of China, and its privacy policy says it may use data to train and improve its models, with a right to opt out; its own terms govern how it handles what it receives. Buildra itself does not sell your prompts or code or use them to train models.
Every Buildra-served page ships a restrictive CSP: default-src 'self', explicit allowlists for analytics and font origins, frame-ancestors 'none', and base-uri 'self'. XSS surface is intentionally small.
Buildra's services are written in TypeScript and run on Fly.io and Cloudflare, with Temporal Cloud coordinating each project's runner. Every project builds on its own runner machine, separate from other people's projects.
Sign-in is handled by Supabase Auth, which stores passwords only as bcrypt hashes, never in plain text. You can also sign in with Google or GitHub. Supabase holds your email address and sign-in details; your projects are stored separately, on Fly.io.
Production access is limited to a small set of core engineers, requires 2FA, and is audit-logged. Customer data is accessed only to investigate a support issue you've opened or to respond to a legal requirement.
Buildra's database, project code and runners are on Fly.io in the United States (Virginia), and runner orchestration is on Temporal Cloud in AWS us-west-2. Model inference is not in the United States: prompts and code are processed by our AI model provider, which states that it stores data in the People's Republic of China. An EU-only or US-only processing option is not offered today.
Your account, projects, code and conversations are kept while your account is in use. A free-plan project that sits idle for six months is moved to cold storage; six months after that, Buildra sends two notices at least two weeks apart and then deletes it. Paying accounts, and accounts whose subscription ended within the last 90 days, are exempt. If you ask to delete your account (in Settings or at privacy@buildra.dev), its data is purged within 30 days. Code you downloaded or mirrored to your own GitHub stays with you; Buildra never reaches back into your repositories.
We aim to acknowledge confirmed security incidents within 24 hours of internal detection or external report and to publish a status update within 72 hours. Customers materially affected by an incident receive direct email notification with the scope, mitigation status, and any required action.
Buildra uses a small set of third-party services to operate. Each one handles a specific slice of customer data; we don’t share data beyond what each processor needs to do its job. The full list is below so you can evaluate compatibility before you ship on Buildra.
| Sub-processor | Purpose | Region |
|---|---|---|
| Fly.io | Hosting for Buildra's services, project runners, the database and project code | United States (Virginia) |
| Tigris | Object storage for workspace snapshots and backups | Not stated |
| Cloudflare | DNS, the API edge, and hosting for published apps and their databases | Global |
| AI model provider | AI model inference: your prompts, code and images | People's Republic of China (per the provider) |
| Temporal Cloud | Coordinating each project's runner | AWS us-west-2 |
| Supabase | Sign-in: email address and password hash | US |
| Stripe | Payments and subscription billing | US / EU |
| AWS SES | Transactional email (account, billing, alerts) | US (us-east-1) |
| PostHog | Product analytics (no prompts or code), and session recordings of visits to buildra.dev | US (us.i.posthog.com) |
| Expo (EAS) | Native iOS and Android builds, and uploads to the stores with your own credentials | Not stated |
| GitHub | Importing repositories and mirroring to a repository you connect | US |
| Google Analytics | Visits to buildra.dev (marketing site only) | US |
| Google Fonts | Web fonts on buildra.dev, which sees visitors' IP addresses | Global |
| MimicBot | The chat widget on buildra.dev: what visitors type into it | Not stated |
We notify customers of any new sub-processor that handles customer data. Email privacy@buildra.dev to subscribe to sub-processor change notifications.
If you believe you’ve found a security vulnerability in Buildra or a Buildra-generated application, please email security@buildra.dev with reproduction steps. Please give us a reasonable window to investigate and remediate before public disclosure. We appreciate the work of the security research community and we’ll credit researchers who report in good faith.
Buildra is not currently SOC 2 certified. For enterprise customers that require a formal compliance posture, email support@buildra.dev — we can discuss the current control set, pending audits, and a contract that covers your specific requirements.
We answer them seriously. Every message to security@buildra.dev gets a human reply.