We take your code and secrets seriously
Preview environments touch real production code, real seed data, and real secrets. Here is how BTS is built to keep them safe — and what we're still working on.
Encryption in transit
Every external endpoint is served over TLS 1.2+. The control-plane-to-agent gRPC channel supports mutual TLS so only enrolled nodes can join the fleet.
Encryption at rest
Environment variables and database passwords are encrypted with AES-256-GCM. Each value gets a unique initialisation vector. The master key is stored in the host environment, never in the database.
Isolation between environments
Every preview runs inside its own containerd container with cgroup-enforced vCPU and vRAM limits. Databases are namespaced per environment and network-scoped to their owning container.
Tenant separation
Projects are scoped by user or team. Every API route enforces ownership and team membership before returning data. We use parameterised queries via Drizzle ORM — no raw string SQL from user input.
Auditability
All deployments, plan changes, team membership changes, and admin actions are recorded in append-only ledgers with the acting user, timestamp, and related resource IDs.
Operational controls
Production databases are backed up daily with point-in-time recovery. Access to production infrastructure requires hardware-key MFA. The full control plane is deployable from a single repo so we can rebuild from source in minutes.
Where your data lives — shared responsibility
What BTS processes depends on where your projects run. Enterprise teams that connect private nodes keep their application data at rest entirely on their own hardware; the BTS control plane handles orchestration, configuration, and routing.
| Data | Shared pool | Your private nodes |
|---|---|---|
| Source checkouts, images, build caches, running containers, application databases | BTS-operated nodes | Your hardware only |
| Environment variables & secrets, repo access tokens | BTS control plane — AES-256-GCM encrypted at rest, decrypted transiently at dispatch | |
| Deployment metadata (branches, commits, changed paths) & build logs | BTS control plane | |
| Preview URL traffic | TLS terminates at the BTS edge, forwarded to the node over an encrypted tunnel | |
| Database seeds/backups & external TCP endpoints | Optional — touch BTS infrastructure only if you upload seeds or create endpoints; skip both to keep database contents off BTS entirely | |
How we handle the data this split puts in our hands is described in our Privacy Policy.
Subprocessors
We keep the list short.
| Subprocessor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Control-plane, database, and edge hosting | Germany (EU) |
| GitHub, Inc. | Source hosting, OAuth, webhooks — via your own GitHub connection | United States |
Compliance & vendor reviews
We are a young company and we are honest about where we are. Here is the current state:
- GDPR-ready data handling. All user data is deletable on request; we do not sell personal data, and we share it only with the subprocessors listed above. Our control plane is hosted in the EU.
- Built for your vendor review. We are not SOC 2 or ISO 27001 certified today and we won't pretend otherwise. Instead, we support your compliance program directly: this page as a living controls document, security-questionnaire responses, and the private-node architecture that keeps your application data on your own hardware. SOC 2 Type 2 teams can use BTS this way — their auditors assess us through vendor management, not through our certification.
Report a vulnerability
Found a security issue? Please email security@test.buildingswell.com with a description and reproduction steps. We triage within one business day and will keep you updated until the fix ships. Act in good faith and we will treat you in kind — no legal action for responsible disclosure.
Want deeper detail? See our architecture docs or reach out for a security questionnaire.