Security

Last reviewed 10 September 2026.

Why this page names what is missing

Most security pages are a row of badges. Ours is not, for a reason that is easy to check: our Data Processing Agreement already states that we hold no certification, so a page implying otherwise would contradict a document you can read in the next tab. If you are evaluating MakerBay for a business that handles other people’s data, the second list is the one worth your time.

In place today

• Encrypted in transit and at rest, across databases and file storage.
• Every record is scoped to one workspace, enforced in a single shared data layer with automated tests covering it. There is no code path that reads across workspaces.
• Point-in-time recovery on customer data, and tables configured so that tearing down our own infrastructure cannot delete yours.
• There are no passwords. You sign in with a one-time code we email you, or with a passkey held on your phone or computer (fingerprint, face or PIN), which never leaves the device. The handful of accounts created before September 2026 keep a password in Amazon Cognito, which we never see, and can switch to a code at any time.
• The staff console runs on a separate identity system from the customer app, so a customer login cannot become a staff login even if something else goes wrong.
• Staff status is checked live on every request, so removing someone takes effect in about a minute rather than whenever their session happens to expire.
• An append-only staff audit log. The service that writes it has permission to add rows and no permission to change them.
• Rate limiting on public endpoints, and per-business daily caps on outbound email.
• Automatic expiry: assistant conversations after 90 days, call recordings after 30, application logs after 12 months.
• No third-party trackers anywhere, including on the pages your customers see. Fonts are served from our own servers rather than Google’s. A test fails our build if that ever changes.
• A signup canary that asks the live sign-in page for a code every hour, waits for the delivery receipt, and alarms if either fails.
• AI inference runs inside our own cloud account. No customer content trains any model.

Not in place. Planned, with dates.

• Role-based limits on staff access — by 31 October 2026. Staff roles are recorded and audited but not yet enforced per action, so any staff member can currently reach any workspace. With one person that is a smaller risk than it sounds, but it is not least privilege and we will not describe it as such.
• Infrastructure-level access logging and threat detection — by 31 October 2026.
• A written, tested incident response runbook — by 30 November 2026.
• Independent penetration testing. Not scheduled. We will commission one before we reach 250 paying businesses, and this page will say so when we do.

If something goes wrong

We will tell affected customers within 48 hours of confirming a breach, and keep telling them as we learn more. Not 24 hours, which is what most agreements promise: 48 is a number we can hit on a bad weekend, and a commitment we would miss is worse than an honest one. The full terms are in clause 8 of the DPA.

Telling us about a problem

Email support@makerbay.app before you tell anyone else, and we will work with you on it. We have no bug bounty budget and will not pretend otherwise, but we will credit you here if you would like us to, and we will fix it.

Please do not test against a real business’s workspace. Create your own free workspace and test against that.