Security & Trust

Coderblock builds and hosts applications for thousands of users, so we treat the security of your code, your data, and your users' data as a product feature — not an afterthought. This page summarizes our security architecture, how we handle your data with AI providers, and the compliance documents available to your team.

EU customers contract with Coderblock Srl (Italy); customers in the rest of the world contract with Coderblock, Inc. (Delaware, USA). Questions? security@coderblock.ai

Isolation by architecture, not just by policy. Every application you build on Coderblock gets its own dedicated backend: a separate database, authentication realm, and file storage, provisioned per project. Your app's data is never stored in a database shared with other customers' apps.

• Each app runs on dedicated virtual machines (preview and production), not in a shared runtime.
• Platform data is protected with row-level security: every query is scoped to the authenticated user.
• Primary hosting regions are in the European Union, with global regions available for latency.

• In transit: all connections use TLS 1.2+ (HTTPS everywhere, including preview apps).
• At rest: project files, databases and backups are encrypted at rest by our infrastructure providers.
• Secrets: API keys and tokens (e.g. your GitHub connection) are stored encrypted and never exposed to other users or to generated apps.
• Payments: card data is handled entirely by Stripe (PCI-DSS Level 1) — it never touches our servers.

Your code and prompts are not used to train AI models. We send your instructions and relevant project context to our AI providers solely to generate and edit your application, under agreements that prohibit training on customer data.

• AI providers process data as subprocessors, only for the duration of the request.
• You choose the generation mode; requests are routed only to the providers that mode requires.
• Project context sent to models is scoped to your project — never other customers' code.

• Multi-factor authentication (MFA) available on all accounts.
• Single Sign-On (SSO) via SAML 2.0 / OIDC (Okta, Microsoft Entra ID, Auth0, and any standards-compliant provider) — available on Business and Enterprise plans.
• Team roles (owner / admin / member) with per-project access restrictions on team workspaces.
• Session tokens are short-lived and refreshed automatically; access can be revoked centrally.

We use the following subprocessors to deliver the service. Each is bound by a data processing agreement:

• GDPR: we support data subject rights (access, rectification, erasure, portability). See our Privacy Policy.
• Data Processing Agreement (DPA): available for Business and Enterprise customers — request it at legal@coderblock.ai.
• Security reviews: Enterprise customers can request our security documentation pack and vendor-questionnaire support.

Found a vulnerability? We appreciate coordinated disclosure. Email security@coderblock.ai with reproduction steps — we acknowledge reports within 72 hours and keep you updated through remediation. Please avoid accessing other users' data and give us reasonable time to fix issues before public disclosure.