Security

Every base on Base Captain is private from the start, keeps its data apart from every other base's, records every change and has its stored data and nightly backups kept in Germany. This page says how.

Who sees what

Private by default.: A new list is seen only by the users who build the base, until you say who else sees it.
A database of its own.: Each base keeps its data in a database of its own, apart from every other base's. What answers your team's requests can neither get around your rules nor reach another base's data.
Rules kept by the database.: Which records each role sees is enforced by the database itself, not only hidden on the screen.
Hidden fields stay hidden.: A field hidden from a role, or one it may not change, stays that way everywhere: on the screens, in downloads, search and totals, and for the assistant and every agent.
Seeing what a user sees.: Only a builder can view the base as a user sees it, without changing anything, and that view is recorded.

Every change on record

Every change recorded.: Each change is recorded with who made it and when, and whether it came from a person, the assistant, an agent, a workflow or another program connected to the base.
Undo and restore.: A change can be undone, and a deleted record restored.
A snapshot before each change.: Before each change to how a base works, a copy of its data is saved. Within an hour the base can go back to that copy; later, a new change undoes it and keeps the data entered since.

Signing in

Passwords.: Optional: you can sign in with a code we mail you instead. Never stored as written, only as a scrambled form that cannot be turned back (salted PBKDF2-SHA256, 210,000 iterations). At least 8 characters. After repeated wrong passwords or codes, sign-in waits a while.
Sign-in codes.: Six digits, mailed to you, good once for 15 minutes. Five wrong tries end a code, and an address gets at most one new code a minute.
One sign-in page.: Your password or code is typed only on Base Captain's own sign-in page, never inside a base. Signing out anywhere signs that browser out of every base.
Two-factor sign-in.: With a code from an authenticator app, asked after the password or the mailed code.
Your sessions.: A list of the sessions you are signed in on, each one revocable. Changing your password signs out your other sessions.
Other sites refused.: Another website cannot act in your name: requests sent from another site's page are refused.
Keys for other programs.: A user can give another program a key of their own (an API token), with that user's permissions, and revoke it at any time.

Code and secrets

Code in a container.: Code Base Captain writes for your base runs sealed off on its own, out of reach from outside. It can contact only the outside services the base allows.
Secrets sealed.: Keys for other services, such as your payment provider’s, are encrypted when stored, never shown again once saved, and kept out of every conversation and log. Each is sent only to the services chosen by whoever entered it, only over an encrypted connection, and the code written for your base never sees it. In a request, each goes only in its own place, such as a header, and never in the body, so it cannot reach someone else’s address on a service that many customers share.
Errors come to us.: A base's errors, on its server and in the pages people use, come to us, the people who run Base Captain, and to the base's builders on its Errors page. Its other users do not see them. What tells the team that builds Base Captain of a fault in Base Captain itself holds no data of the base: only where in our code it failed. The people who run Base Captain also keep a list of those faults, the Feed, with each base and its scrubbed error message, to repair the service: it holds no chat, and no base that keeps its data from AI.

Hosting and backups

Stored in Germany.: Every base’s stored data (its records, files and backups) is kept on our servers at Hetzner, in Falkenstein, Germany, in the European Union. What the assistant and the agents send to the AI does not stay there: it goes to the USA, and the subprocessors page says to whom.
Backed up every night.: Every base's data is backed up every night, and each night's backup is kept for ninety days. A change to a few records needs no backup: undo it from the history.
Kept apart.: Backups are kept on separate storage, apart from the servers.
Encrypted copies.: Each base's data is also copied every night on its own, encrypted with a key of its own.
Watched.: If a backup fails, we are told at once.

When something breaks

The status page says whether Base Captain works now. It does not run on our servers, so it answers when they do not. Within 24 hours of an incident we write a report there: what happened, what you saw, what we did and what we change.

Your data, in writing

The data processing agreement sets out how we handle the data in your bases, and the subprocessors page lists the companies that handle it for us.

Reporting a security issue

Write to [email protected] with what you found and how to see it.