Security

Proyecta is a platform where your source code, prompts, and project data flow through AI systems and isolated execution environments. Protecting that data is foundational to how we build the Services. This page summarizes our security practices in plain language; it supplements our Privacy Policy, Terms of Service, and the Subprocessors list.

For security questions, enterprise security reviews, or to report a vulnerability, contact security@proyecta.dev.

1. Infrastructure and Hosting

The Services run on Google Cloud Platform, on Google Kubernetes Engine in Google's us-central1 region in the United States. A Google-managed Layer-7 load balancer with Google Cloud Armor sits in front of our public endpoints, providing DDoS protection, web application firewall rules, and rate limiting; static assets are served via Google Cloud CDN. Cloudflare provides authoritative DNS and TLS-certificate validation, and edge delivery for user-published apps (*.proyecta.live).

Our databases have no public IP address: they can be reached only over Google Cloud's private network. They are backed up daily, and we can restore them to any point in the last 7 days.

Most of our requests to Anthropic, our main AI model provider, are relayed through a server that Proyecta operates outside Google Cloud, reached over an authenticated, encrypted Cloudflare tunnel. That server keeps copies of the requests and responses it relays so we can diagnose problems.

We do not operate our own data centers. Our cloud providers maintain their own independent infrastructure security certifications, and a current list of the providers that process data on our behalf is published on our Subprocessors page.

2. Encryption

• In transit: All traffic between you and the Services is encrypted using TLS 1.2 or higher, and so are our services' connections to our databases.
• At rest: Our databases, file storage, and backups on Google Cloud are encrypted at rest with Google-managed keys.
• Secrets: Platform credentials are kept in Google Cloud Secret Manager. Tokens and credentials for the services you connect, including payment providers, are stored encrypted in our database. Neither is placed in client-side code.

3. Access Controls

• Limited access. Access to production systems and customer data is limited to authorized Proyecta staff. Our admin tools give each staff member their own account and a role that limits what they can do.
• Activity logging. Actions staff take in our admin tools are logged, including each time a staff member signs in to a customer's account to help them. In apps built with Proyecta, every time someone opens a client's clinical record is logged.
• Confidentiality obligations. Staff with access to Content are bound by confidentiality obligations.

As described in our Privacy Policy, authorized personnel access Content only as necessary to provide support, debug issues, maintain reliability, or comply with legal obligations.

4. Your Code and AI Data Handling

This is the question most customers care about, so we state it plainly:

• We do not train AI models on your Content. We do not use your code, prompts, or data to train or fine-tune AI models, and we do not send your Content to AI providers for the purpose of training their models.
• How we use your Content. We use your Content to provide the Services to you. Our team also reads projects and AI conversations when needed to support you and to find and fix problems.
• Third-party AI providers. To produce responses, inputs are sent over their APIs to AI providers: Anthropic and Google for language models, Google and OpenAI for image generation, Deepgram for speech-to-text, ElevenLabs for text-to-speech, and Tavily for web search and reading web pages. Anthropic, Google, and OpenAI process these inputs under API terms that, as currently written, do not let them train their models on customer inputs. We do not control these providers, and their data handling is governed by their own terms, which you should review independently (see Terms §10.2).
• Product analytics. We use PostHog to understand how the Services are used: pages visited, actions taken, and session recordings, as described in our Cookie Policy. Our team reviews this data to improve the Services and to help customers.

5. Runtime Isolation

Code generated and run by the Services executes in dedicated Kubernetes pods, separate for each project, in a namespace apart from our own services. Network rules stop runtimes from reaching one another or our internal network, and let traffic in only through our own services. Idle runtimes are suspended and later archived, which limits what any single runtime can affect.

6. Vulnerability Management

• We track our software dependencies for known vulnerabilities with automated tooling and apply updates on a risk-prioritized basis.
• Responsible disclosure. If you believe you have found a security vulnerability, please report it to security@proyecta.dev. We will acknowledge your report, investigate promptly, and keep you informed. Please give us a reasonable opportunity to remediate before any public disclosure.

7. Data Retention and Deletion

We retain information only as long as necessary to provide the Services and meet legal obligations. We keep your account, your projects, and your conversation history, including prompts and generated outputs, while your account is open.

You can ask us to delete your account at any time, in the Proyecta app under Settings or at app.proyecta.dev/delete-account. Until we complete the request you can keep using the Services and withdraw it. We complete it within 30 days: we delete your account and sign-in details, your sites with all their content, and your customers' data stored in them, and we cancel any active plan. We keep only the records the law requires, such as invoices and payment receipts, for as long as the law requires. Deleted data remains in our database backups until those backups expire. Full details are in Privacy Policy §4.

8. Incident Response

We have a documented incident response plan for security events. In the event of a breach involving your personal data, we will notify affected customers within 72 hours of discovery where feasible, or sooner where required by applicable law, including the nature of the incident, the data affected, and recommended actions.

9. Subprocessors

We use third-party service providers to operate the Services. Each is bound by its data-processing terms to protect the data it processes on our behalf. The complete, current list — including each provider's purpose, the data it processes, and its location — is published on our Subprocessors page, which describes how we provide notice of changes.

10. Compliance and Security Reviews

• Data Processing Agreement. Customers who act as a data controller may request a DPA that supplements our Privacy Policy with additional data protection commitments. Contact legal@proyecta.dev.
• Security questionnaires. We are happy to complete vendor security questionnaires and support enterprise security reviews — contact security@proyecta.dev.
• Subprocessor transparency. Our subprocessor list is public and kept current.

As Proyecta grows, we continue to expand our formal security and compliance program. For the current status of any specific certification or attestation, please reach out and we will share where we are.

11. Contact

• Security and vulnerability reports: security@proyecta.dev
• Privacy inquiries: privacy@proyecta.dev
• Legal and DPA requests: legal@proyecta.dev