Security at commbini

Your data is isolated to your account

Every account's uploaded documents and knowledge base live in a private, per-account search index, separate from every other account's. On top of that, every single database query is scoped to the account that made the request — there is no path in the application that lets one account read, change, or delete another account's data.

This isn't just an intention. Our automated test suite includes an adversarial set of tests that log in as one account and try to reach a second account's projects, documents, knowledge base, and history through every endpoint. Those attempts must fail for the tests to pass, and they run on every change to the codebase.

Encryption & infrastructure

All traffic between you and commbini is encrypted in transit with TLS (HTTPS) — everywhere, with no unencrypted fallback.

• Authentication is handled by Clerk, a specialist identity provider. We never see or store your password.
• The application and database run on managed cloud infrastructure (Railway); our website runs on Vercel.
• Access to production systems is limited to the operator and protected by the providers' own account security.

We never train AI models on your data

To produce an analysis or plan, the text you submit is sent to our AI provider (Anthropic) solely to generate your result. It is not used to train AI models — not ours (we don't train any) and not the provider's. Your uploads and outputs are yours; we don't sell them, and we don't use them for advertising.

An append-only activity log

Key actions on your account — document uploads, deletions, and exports — are written to an activity log that is append-only: entries can never be edited or removed, by you or by us, including by our own database account. It's enforced at the database level, not just in the app.

On paid plans you can view your own activity log in the app and export it as a CSV — a record you can use to demonstrate to your own clients how their material has been handled.

Deletion & erasure

You can delete your account from your settings at any time. Doing so immediately and permanently erases all of your data — uploaded documents, your knowledge base, saved projects, analyses, and your activity history — across both our database and the search index. When a document is deleted, its searchable text is removed first, so a deleted document can never linger in analyses.

We also automatically erase the data of accounts that have been inactive for twelve months. Paying customers and accounts with an active subscription are never caught by this — inactivity means genuinely dormant, non-paying accounts.

What we can and can't see

We want to be straight with you, because trust is easier to keep than to rebuild. Because we operate the servers and hold the database, we are technically capable of accessing stored data in order to run, support, and debug the service. We do not claim otherwise.

What we do instead is minimise and account for that access:

• No internal tool or admin screen exposes the contents of your documents, knowledge base, or analyses. Our admin views show account and usage information only, never your material.
• Every administrative action is written to the same append-only audit log described above.
• We never use your content to train models, sell it, or use it for advertising.

True end-to-end encryption — where even we could not read your content — is on our roadmap (see below). Until it ships, we won't imply an absolute we can't yet honour.

Who processes your data

We use a small set of established providers to run the service. Each one only handles what it needs to:

• Railway — Hosts backend and the database where user accounts, uploaded document text, and usage history live.
• Clerk — Stores and processes names, email addresses, and login credentials.
• Anthropic — Processes the text of briefs, tenders, and documents you submit in order to generate analyses and plans. Your data is not used to train AI models.
• Vercel — Hosts our website and processes visitor IP addresses and request logs.
• Stripe — Processes payments on our behalf.

Some of these providers process data outside the UK, under safeguards required by the UK GDPR. Our privacy notice lists exactly what each one handles and where.

What we don't claim (yet)

commbini is a young product, and we'd rather under-claim than mislead. We do not hold formal security certifications such as ISO 27001 or SOC 2, and we will never imply that we do. We have not commissioned a third-party penetration test.

What we're working toward, in rough order:

• Customer-managed encryption, so that even we cannot read your content at rest.
• An independent, third-party security assessment.
• Formal certification as the product and team grow.

If any of these are prerequisites for your organisation, tell us — it helps us prioritise.

Reporting a vulnerability

If you believe you've found a security vulnerability, please tell us before disclosing it publicly. Email us with the details and we'll acknowledge your report and investigate. We're grateful for responsible disclosure.

Email: hello@commbini.com