Security

Our approach

Security is a shared responsibility: allybuild protects the platform, your data, and your runs, while organization owners manage member access within their organizations.

Workload isolation

Every run executes inside an isolated workspace scoped to your organization, with its own environment, files, and boundaries. One organization’s runs cannot touch another’s data.

Encryption

Data is encrypted in transit with TLS and encrypted at rest in our storage systems, including run artifacts and memory stored for your organization.

Access controls and auditability

Internal access to production systems follows least privilege and is limited to personnel who need it to operate the service.

Inside the product, role-based permissions let organization owners control what members can do, and plan and quota changes leave an audit trail.

AI subprocessors

Agent inference runs on third-party model providers. We review providers before adding them, contractually restrict how they may process your data, and keep the list of subprocessors available on request.

Payments security

Payments and credit top-ups are handled by Stripe, a PCI DSS compliant payment processor. Card details go directly to Stripe; allybuild never stores full card numbers.

Backups and incident response

We back up critical data and test recovery procedures. If a confirmed security incident affects your organization, we will notify you without undue delay and share what happened and what we did about it.

Reporting vulnerabilities

Found a vulnerability? Email business@allybuild.ai with details. We welcome responsible disclosure and will not take action against good-faith research.