Skip to main content
Biscuit handles the security work you’d otherwise need an engineer for. Apps run on managed cloud infrastructure, data is encrypted in transit and at rest, and authentication uses standard secure patterns. The team is responsible for keeping your app and your users’ data safe, the same way any other production platform would be.

​
What Biscuit handles

  • All data is encrypted in transit (TLS) and at rest using cloud-provider encryption.
  • API keys you connect (Stripe, email, third-party integrations) are stored encrypted by Biscuit. You enter these in a secure field, never in the chat. They’re encrypted per project, stored separately from your app, and can’t be viewed again once saved, not even by Biscuit team. The AI-written code never handles them. A key is only decrypted at the moment your app calls the outside service, through a proxy layer. You can rotate or remove keys in Settings.
  • User sign-in uses standard secure patterns. Google OAuth is the default; other providers can be added.
  • Apps run on managed cloud infrastructure operated by Biscuit.
  • The platform is kept up-to-date against known vulnerabilities.
  • When you publish, Biscuit runs automated checks on the app config to catch obvious issues before going live. Today this covers payments setup; more checks are on the roadmap.

​
SOC 2 and the trust center

Biscuit is working toward a SOC 2 Type 2 report and ISO 27001 certification. Our controls are monitored continuously in Vanta, and the audit is currently in progress. You can follow the latest updates here → Biscuit Trust Center The Biscuit Trust Center lists the security controls in place, such as production access restrictions, encryption, and incident response, and it will show the audit’s status as it moves along. If someone at your company needs to review Biscuit before you build on it, that’s the page to send them. For a vendor review, the Resources tab in the Trust Center has the documents available to share today. Email support@biscuit.so if you need something that isn’t there.

​
What you’re responsible for

  • If any API keys you’ve connected are compromised at the provider’s end, you must rotate them yourself (please contact us if you have questions).
  • If your app collects sensitive data from users, you handle legal compliance, privacy policy, and what you do with the data.
  • You configure who can read, write, and delete records in your app’s data. Set those permissions deliberately.

​
FAQ

On managed cloud infrastructure operated by Biscuit. The team can share detailed architecture on request.
Yes. The Data section of your project lets you export every model as CSV. For full backups, contact the team at support@biscuit.so
Not yet. Biscuit has committed to a SOC 2 Type 2 report, and the audit is currently in progress. You can follow progress in the Biscuit Trust Center, which also lists the security controls already in place.

​
Up next

What is Biscuit?

The platform, who it’s for, and what you can build.

Connecting external APIs

Pull live data from any service into your app.