Security you can read in the code.
Because components ship as source, there's no opaque runtime executing in your app. Here's how we protect the platform around it.
Keys hashed at rest
API keys are shown once and stored only as hashes. Revoke instantly — active sessions stop at once.
Encrypted in transit
All traffic is TLS 1.3. The MCP endpoint accepts bearer tokens only over HTTPS.
No code execution
We deliver text, not a runtime. Nothing from build69 executes in your users' browsers.
Audit logging
Every fetch is recorded per key so you always know what your agents accessed and when.
SSO & SCIM
Team plans support single sign-on and directory sync for provisioning and offboarding.
Data minimalism
We store your account, keys, and usage counts — nothing about the apps you build.
Report a vulnerability
Found something? We respond to security reports within one business day and credit responsible disclosure.