> ## Documentation Index
> Fetch the complete documentation index at: https://docs.biscuit.so/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQs for IT and procurement teams

> Answers to common questions about how Biscuit is built, secured and hosted, for IT and procurement teams

## About apps

> **How are Biscuit apps built under the hood?**
>
> Every app has three parts: views (the screens, built as React components), workflows (the logic, written as durable TypeScript functions that run reliably to completion) and models (where the data lives). Biscuit's AI writes the code on Biscuit's own framework, which is tied closely to the infrastructure. That lets the platform control what code can run and what it can reach.

> **Can my whole company use Biscuit?**
>
> Yes. Your company gets one workspace, each team gets its own space, and you decide who can use or edit every app. See [Access control](/access-control.md) for how it fits together.

> **Can we see and edit the code of the app built in Biscuit?**
>
> No. In Biscuit, you cannot see or edit the code of your app. However, Biscuit generates readable views from the code itself. Data models show as tables with their fields and types, and workflows show as diagrams of each step in the order it runs. See [Workflows](/workflows.md).

> **Where does Biscuit’s own infrastructure run?**
>
> Apps run on managed cloud infrastructure operated by Biscuit.

> **Is Biscuit a no-code block tool like n8n?**
>
> No. The AI writes real TypeScript. It can use npm packages and call AI models. Biscuit shows workflows as step-by-step diagrams so non-developers can follow them, but what runs underneath is code.

> **How is Biscuit different from vibe-coding tools?**
>
> Vibe-coding tools give you code and leave security, permissions and hosting to you. Biscuit's AI builds on a framework and infrastructure designed together, so permissions, data protection and access control are built into every app rather than added by hand.

## App data and databases

> **What database does Biscuit use for my apps?**
>
> A database built for Biscuit, with SQLite underneath. Every workspace gets its own dedicated database. It works as both a regular database and a real-time sync engine, so when data changes, everyone using the app sees it live.

> **How is access to individual records enforced?**
>
> Apps never talk to the database directly. Each model has rules for who can read, create, update and delete records, and those rules can follow your team structure. If no rule is set, nobody can reach the data. See more in [Access control](/access-control.md).

> **Do we need to design the database schema?**
>
> No. Biscuit's AI designs the data models as it builds, as small linked tables. You can guide it if you have a structure in mind, and change models any time in chat. You can see the database in Library → App → Tables.

> **How are schema changes and migrations handled?**
>
> Schema changes are always backwards compatible. When a field is no longer needed, it's deprecated rather than removed, so there's no migration that takes your database offline. If you've used Firebase, it works in a similar way.

> **Will our apps stay fast as our data grows?**
>
> Yes. Biscuit's compiler analyzes every query in your app and creates the indexes it needs automatically. When a page loads, the data it needs is already included, so there's no wait for a second round of queries.

## Isolation between customers

> **Is our data separated from other customers' data?**
>
> Yes. Each workspace's app data lives in its own single-tenant database. No two companies share a database. Account details such as users, teams and permissions are managed by a separate central service.

> **Could someone see another company's data by changing the project ID in an app link or request?**
>
> No. There's no shared database to reach into. Every request is routed to a specific project and carries a signed token, which is verified before the database is touched. Changing the project ID gets you nowhere unless your token gives you access to that project.

## Integrations and credentials

> **How are API keys and credentials stored?**
>
> API keys you connect (Stripe, email, third-party integrations) are stored encrypted by Biscuit. You enter these in a secure field, never in the chat. They’re encrypted per workspace, stored separately from your app, and can’t be viewed again once saved. The AI-written code never handles them; AI can never read the API keys as it is handled by Biscuit’s proxy layer. A key is only decrypted at the moment your app calls the outside service, through a proxy layer. You can rotate or remove keys in *Settings.*

> **Can the AI see our API keys, or send them somewhere else?**
>
> No. The AI-written code never handles keys. When your app calls an outside service, the request goes through Biscuit's proxy, which adds the key at that moment and only allows calls to approved domains. A key can't be sent to an unknown server.

> **Can we customize an integration?**
>
> Yes. An integration is built like an app, so whoever installed it can ask Biscuit to extend it. For example, add a HubSpot API call the default integration doesn't include. The credentials stay locked; only the integration's logic changes.

> **Can other teams use an account we've connected, like HubSpot?**
>
> You choose. Share the connection itself with another team so they can build with it. Or share only an app that uses it: people can use what the app does, but never get access to the credentials.

## Access and governance

> **Can we control who publishes apps to the public web?**
>
> Yes, through edit access. Only people with `Can edit` access to an app can publish it, including to the web. Give `Can edit` only to the people who maintain each app, and keep sensitive tools in Private spaces or restricted access. Apps stay inside your workspace until someone with edit access makes them public. See [Publishing your app](/publishing-app.md).

> **Is app activity logged?**
>
> Yes. Every workflow run is recorded, including who ran it and when. We also record what was published and who published it.

> **Can we restrict access to our VPN or an IP allowlist?**
>
> Not today. If this is a requirement for your company, email [support@biscuit.so](mailto:support@biscuit.so).

## Biscuit AI security

> **Which AI models does Biscuit use to build apps?**
>
> Biscuit uses Large language models (LLMs) from several providers, including Anthropic, OpenAI and Google, plus open-weight models. Biscuit splits building into tasks, benchmarks models for each one and uses the best fit, so it isn't locked into any single provider.

> **Which AI models can run inside our apps?**
>
> Apps can use AI for text, images and voice, for example a workflow step that writes a summary, generates an image or creates a voiceover. Biscuit benchmarks models for each kind of task and picks the best one for every step. You can switch models the workflow settings.
>
> Biscuit uses top models from frontier labs including OpenAI, Anthropic and Google, such as GPT-6, Claude Opus 5.5 and Gemini 4. New models are added as soon as they’re released. Any model that is on the frontier (price, quality or speed), and potentially useful for users of Biscuit is evaluated and added with the right description of where it can be used best.

> **Is our data used to train AI models?**
>
> No. Biscuit does not use your data to train AI models.

> **Where is our data hosted? Can it stay in the EU?**
>
> Today, Biscuit runs on infrastructure that includes the US. EU-only hosting is on the roadmap. If data residency matters for your company, email [support@biscuit.so](mailto:support@biscuit.so) and we'll talk through options.

> **Is Biscuit SOC 2 or ISO 27001 certified?**
>
> Not yet, but both are in progress. Our SOC 2 Type 2 audit is underway, with ISO 27001 running alongside it. We partnered with Vanta and you can follow the audit status and see the controls already in place in our [Trust Center](https://trust.biscuit.so/).

> **Has Biscuit been penetration tested?**
>
> A penetration test is underway as part of ISO 27001.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.