Security by design,
not by claim.

Data protection

Your data is yours. BASE never sells it, never trains external AI models on your private content, and never shares it with third parties except where strictly needed to operate the service — with full disclosure of who, what, and why (see sub-processors).

Every user can export their data and delete their account from Profile. Deletion removes active content promptly; residual provider backups, where present, roll off within the limited retention window described in the Privacy Policy.

Agent coordination controls

The six core agents — Document, Finance, Wellness, Organizer, Mentor and Action — have distinct responsibilities, while a shared Orchestrator selects the specialist and preserves conversation continuity.

Every request is bound to the authenticated user, and owner checks protect stored documents, tasks, messages and records. In the current version, the selected specialist may receive recent conversation plus limited goal/document context without a separate hand-off prompt. Record-creating cross-agent actions and supported external actions use visible preview or confirmation controls; connected services retain their own permission scopes.

What's protected today

Concrete safeguards already in the product:

• Password hashing with bcrypt. Passwords are never stored in plaintext.
• JWT-based session tokens for authentication. Each request is verified before access.
• HTTPS / TLS for all communication between the app and our servers.
• Per-user data scoping. Every database query is bound to the authenticated account; data belonging to one user is architecturally isolated from another.
• Rate limits on sensitive endpoints (authentication, AI calls) to deter brute-force and abuse.
• Signed webhook handlers for payment and communication integrations.
• Security headers on frontend and backend: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy.
• AI processing via Anthropic Claude. Anthropic does not use BASE customers' data to train its models.
• Cloud hosting on Digital Ocean infrastructure; the current application server is in the United States.
• PostgreSQL on Neon with SSL-encrypted database connections.
• SSH key-only server access. No password authentication to infrastructure.

In progress

Active work expanding current safeguards:

• More granular per-file access controls.
• Stronger user-facing data export and deletion tools.
• Unified upload limits and clearer file-retention rules.
• Expanded audit events covering uploads, exports, agent actions and account changes.

Security roadmap

Planned enhancements as BASE moves toward business and enterprise customers:

• Passkeys (WebAuthn) and two-factor authentication.
• Enterprise DPA (Data Processing Agreement) template for B2B customers.
• External penetration testing engagement.
• SOC 2 readiness — part of our long-term security roadmap as usage and customer profile grow.
• Advanced role-based permissions for family and team workspaces.
• Managed encrypted object storage for uploaded files, with per-user access controls and short-lived file access links.

Sub-processors

BASE relies on a small set of third-party providers. Each is contractually bound to handle your data only on our instructions and to maintain appropriate security and confidentiality.

• AI model processing — Anthropic (Claude).
• Cloud hosting — Digital Ocean (current application server: United States).
• Database — Neon PostgreSQL over TLS in the EU (eu-central-1).
• Email delivery — for transactional and notification messages.
• Voice and transcription — only invoked when you use the Action agent's call features.
• Payment processing — subscription and approved in-app purchase processing through Apple or another disclosed compliant provider. BASE never stores full card numbers.
• Application monitoring — error diagnostics and reliability.

The public Privacy Policy lists current provider categories and named providers. B2B and partner customers can request an up-to-date copy from privacy@base-ai.app.

Compliance & legal basis

• GDPR. Full user rights: access, rectification, erasure, portability, restriction, objection. Lawful basis declared per processing purpose. See Privacy Policy.
• EU DSA. Single point of contact for users and competent authorities: legal@base-ai.app.
• EU AI Act. BASE is designed as a productivity assistant, not a high-risk AI system. We monitor regulatory guidance and adjust where needed.
• International transfers. Current infrastructure includes processing outside the EU/EEA. Where required, BASE relies on safeguards such as Standard Contractual Clauses and applicable adequacy decisions.

Professional boundaries

BASE helps you organize information and prepare for action. It does not replace a doctor, lawyer, accountant or financial advisor.

For decisions that require professional judgment — medical diagnosis, legal advice, tax filing, financial planning — consult a qualified professional in your jurisdiction.

In an emergency, call your local emergency number. BASE is not an emergency service.

Responsible disclosure

We welcome reports of potential security vulnerabilities from the security research community.

How to report

• Email: security@base-ai.app
• Subject: [security] + short summary
• Include: reproduction steps, affected URL, severity assessment, and your contact for follow-up.
• PGP key available on request for sensitive reports.

What we ask

• Give us reasonable time to investigate and fix before public disclosure.
• Don't access, modify or delete data belonging to other users.
• Don't run high-volume traffic or denial-of-service testing without coordination.
• Don't social-engineer our team or third parties.

Safe harbor

Good-faith security research conducted in accordance with this policy will not result in legal action from BASE. We commit to working with researchers to verify, fix and credit findings where appropriate.

Bug bounty

A formal bug bounty program remains on the security roadmap without a public launch date. In the meantime, qualifying reports may receive acknowledgement in our security hall-of-fame.

Incident response

If a security incident occurs that may have affected your data, we will:

• Investigate the scope and impact promptly.
• Contain the incident and remediate the underlying cause.
• Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours where GDPR Article 33 applies.
• Notify affected people without undue delay where GDPR Article 34 applies.
• Provide appropriate plain-language updates about impact and protective steps, subject to security, privacy and legal constraints.