How Biscuit keeps your company data secure

When a whole team builds on one platform, the first question is rarely "does the app work?" It's "who can see what's inside it?" We built Biscuit so the answer is clear from day one. What your team builds stays inside your workspace, and the people who own it decide who gets access. The rules are enforced on our servers rather than written into each app by hand.

Private until you decide otherwise

Everything your team creates belongs to the space it was built in. Take a CRM for your sales team, for example. The database holds customers and deals, and the team uploads contracts and pitch decks alongside them. All of it stays visible only to your team unless someone explicitly makes it public.

Access you control at three levels

Permissions follow the way your company is already organised, so you can open things up for one team without opening them up for everyone.

• Workspace: only the workspace owner can invite new members. Everyone signs in through Biscuit's authentication, and access can be revoked at any time.
• Space: the space owner decides who can reach the apps, data, and files inside, and whether each person can use them or also edit them.
• App: each app can be shared with Can use or Can edit access. Before you share, Biscuit shows what the app depends on: which data it reads and which connected accounts it uses. Nothing is shared by surprise.

Protection that's on by default

Most security advice for AI-built apps starts with "remember to…". In Biscuit, the important protections are already switched on.

• Every data table has rules for who can create, read, update, and delete records. If no rule is set, nobody gets access.
• Those rules run on Biscuit's servers, not in the browser. Apps never talk to the database directly. Every read and write goes through our data layer, which applies your permissions and field types before anything is saved.
• Each time the AI changes a data model, a separate security review checks it for exposed personal data and for permissions that are broader than they should be.

Keys and secrets the AI never sees

Apps often need API keys for external tools. You enter these in a secure field, never in the chat. They're encrypted per project, stored separately from your app, and can't be viewed again once saved, not even by Biscuit team. The AI-written code never handles them. A key is only decrypted at the moment your app calls the outside service, through a proxy layer. You can rotate or remove keys in Settings.

Changes you can undo

• The AI can't quietly delete records. Deleting data goes through a dedicated step that checks what depends on those records and asks for approval first.
• Backups run continuously, and data can be restored to any point in the recent past.
• Every app has a full version history, so any earlier version can be restored in one click.

Where your data lives

Your data runs on managed Google Cloud and Cloudflare infrastructure, encrypted in transit and at rest.

Compliance

• GDPR: if you're in the EU, you can ask us for a copy of your data, correct it, export it, or have it deleted, just email privacy@biscuit.so. When you delete your account, we remove or anonymize your personal data within 30 days. When data is processed outside the EU, we use the European Commission's standard contractual clauses. Analytics on the apps you build are cookie-less and respect “Do Not Track.”
• SOC 2: our audit is currently in progress.
• ISO 27001: we are also working towards ISO certification.

To see the latest updates, follow trust.biscuit.so and for any specific questions, reach out to support@biscuit.so

You own what you build

Your apps, data, and content are yours. You can export any table as CSV at any time. If you ever want to move off Biscuit, we'll help.

Biscuit is built so every team in your company can build the tools it needs, inside one workspace where access is clear and the safeguards come built in.