Secure by design
Choose where your data lives, enforce SSO and role-based access, control publishing with approvals, and keep your code and prompts out of model training.
Enterprise security controls
Enforce SSO and role-based access so only the right people can edit, publish or manage billing — with audit logs for every action.
Choose where your data lives
Keep customer data in the regions your compliance requires, with encrypted connections throughout.
Automatic security scanning
Every publish is scanned for common vulnerabilities before it reaches production — protection that never sleeps.
Tested like an attacker would
Independent pentests and continuous monitoring mean issues are found and fixed before they matter.
Controls
Guardrails for building & publishing
Access and control
Freebuff integrates with SAML and OIDC providers including Okta, Azure AD, and Google. SCIM supports automated provisioning and deprovisioning. Permissions are role-based and enforced server-side across viewing, editing, approving, and publishing.
Guardrails for building & publishing
Editing, approval, and publishing are separate permissions. Public access is controlled by role and environment settings, so teams can move quickly without risking accidental exposure.
Secrets are handled securely
Secrets are encrypted at rest and access-controlled by role. They are not exposed in plaintext in logs or interfaces. Access is limited to authorized environments and actions.
Continuous monitoring & abuse detection
Freebuff continuously monitors platform activity for misuse, anomalous behavior, and compromise. Automated systems enforce rate limits and detect abuse across users and workspaces.
Protected infrastructure
Freebuff Cloud is protected by web application firewall (WAF) controls, network isolation, encrypted data storage, and adaptive rate limiting at the IP, user, and workspace level.
Founder security
Get an audit-ready report for SOC 2, ISO 27001, and investor due diligence. A basic security scan runs automatically before every publish. Run a deep AI-powered scan on demand to analyze your full codebase.
FAQ
Frequently asked questions
Where is customer data stored?
Customer data is hosted in Freebuff Cloud in supported regions including the EU, US, and Asia Pacific. Data residency is region-specific and does not move across regions by default.
Is customer data used to train AI?
On Business and Enterprise plans: No. Customer prompts, code, and workspace data are not used to train Freebuff models. If you are on a Free or Pro plan, log in, open Account Settings → Privacy, and turn off "Use my Freebuff content for model training" to exclude your own data from AI model training. Where third-party AI providers are used, contractual agreements restrict training and retention of customer data.
Is Freebuff multi-tenant, and how is customer data isolated?
Freebuff is a multi-tenant platform with logical isolation between workspaces and projects. Customer data is not accessible across accounts. Isolation controls are enforced at both the application and infrastructure layers.
Which subprocessors does Freebuff use?
Freebuff works with a limited set of infrastructure and AI subprocessors. All subprocessors are covered under contractual data protection agreements. A current list of subprocessors is available upon request.
Does Freebuff access or clone our source code?
No. Freebuff does not clone customer Git repositories, access application code inside your environments, or require internal CI/CD access. Your source code, repositories, and production infrastructure remain inside your organization's existing security perimeter.
Does Freebuff require access to our CI/CD pipelines or production infrastructure?
No. Freebuff does not require direct access to customer CI/CD pipelines or production infrastructure. It does not deploy agents inside production environments or introduce inbound network connections. All integrations operate within defined permission boundaries.
How are publishing controls enforced?
Publishing permissions are enforced server-side and cannot be bypassed via client-side requests. Editing, approval, and publishing are separate role-based permissions. Production publishing can require explicit approval, and all publishing events are logged with user attribution.
How does Freebuff enforce role-based access control (RBAC)?
Freebuff integrates with SAML and OIDC identity providers and supports SCIM for automated provisioning and deprovisioning. Access is role-based, with permissions explicitly defined for viewing, editing, approving, and publishing. All authorization checks are evaluated server-side at request time.
Does Freebuff support least-privilege access?
Yes. Freebuff supports least-privilege access through role-based permissions and integration with enterprise identity providers. Organizations can define granular roles for editing, approving, and publishing, ensuring users receive only the access required for their responsibilities.
How are secrets and API credentials managed?
Secrets are encrypted at rest and scoped to specific environments. Access to secrets is role-controlled and auditable. Secrets can be rotated or revoked without requiring full system redeployment. Integrations execute within predefined permission boundaries to reduce unintended credential exposure.
Does Freebuff perform automated security scanning?
Yes. A basic security scan runs automatically every time you publish, covering database configurations, RLS policies, and cloud project settings (~10-15 seconds). A deep security scan is available on demand and analyzes your full codebase (~3 minutes). Workspace admins can enable auto-fix to have the agent resolve non-breaking findings automatically.
Is Freebuff SOC 2 or GDPR compliant?
Freebuff supports SOC 2 and GDPR requirements and provides security documentation and data protection agreements for enterprise review.
Ready to bring your idea to life?
Describe it in words — Freebuff designs, builds and ships it with you.