Your work, protected.
We are a small company building AI that does real work. Here is exactly how we protect what you trust us with, and where we are honest about what is still ahead.
Encrypted in transit
Every connection to our products, and to the apps they host, uses HTTPS.
Secrets sealed at rest
API keys and access tokens you add are encrypted with AES-256-GCM and released only to the process that needs them.
A separate database per app
Each app built with Co-Create gets its own database, apart from Co-Create's and from every other customer's.
Isolated builds
Code is built and tested in a fresh, isolated cloud sandbox for each run, and new code packages are checked before they are added.
Access checked twice
Browser access to data is limited by row-level security in the database, and every server request checks ownership and membership in code.
Account protection
Hashed passwords, signed-in device tracking, new-device alerts, two-step sign-in (rolling out now), and every session revoked when a password is reset.
You approve every build
No code is built or shipped without your approval, and app code can be rolled back to an earlier point.
Your data, your call
Download your app code at any time, and delete your data or your whole account yourself.
Stored in the United States.
Our primary systems are in the US. Our providers are listed, with what they do, on the subprocessors page.
Co-Create's data
Supabase, United States (Ohio)
Databases of apps you build
Supabase, United States (Virginia)
Websites and app hosting
Netlify, United States, with a global delivery network
Builds and background work
Modal and DigitalOcean, United States (New York)
Sent only where a task needs it.
AI features send the content they need to our model providers, Anthropic and OpenAI, under business terms that do not train on it by default. We never train our own models on your content.
Read more in our Privacy Policy and Responsible AI principles.
Honest about where we are.
We do not hold third-party certifications yet. This is what is in place today and what we plan next.
In place
- Privacy Policy and Data Processing Addendum with EU Standard Contractual Clauses
- Published subprocessor list
- Vulnerability disclosure policy with safe harbor
- Texas TDPSA and California CCPA rights for every US user
Planned as we grow
- An independent penetration test
- A SOC 2 Type I report, followed by Type II
- A public security whitepaper
Report a vulnerability
Found a security issue? We respond within 3 business days and offer safe harbor.
Security questionnaires
Evaluating us for your business? We will answer your security review and countersign our DPA.
Last reviewed October 28, 2026. See every document in the Legal Center.