Security & Trust

Our approach

CoIntegrate is a product of BotLabHQ. We take a practical, honest approach to security: this page describes the controls that are in place today, and — clearly separated — the items on our roadmap. We would rather tell you exactly where we stand than imply certifications we do not yet hold. If you need more detail for a security review, email info@botlabhq.com.

Data protection

• Encryption in transit — TLS on all public endpoints, with HTTP Strict Transport Security on the application domain.
• Encryption at rest — provided by our database and hosting providers.
• Per-account isolation — conversations, uploads, and generated artifacts are scoped to your account and served only to the authenticated owner.
• Tenant credentials — SAP tenant OAuth credentials you connect are stored encrypted and used only to call your tenant on your behalf.
• Payment data minimisation — card data is handled entirely by our PCI-DSS Level 1 payment processor. We never receive or store full card numbers.
• Pseudonymisation — client IP addresses are stored only as a salted hash, never in plaintext.
• Retention — generated artifacts are deleted automatically 30 days after they are created.

Application security

• Access control — every route requires a verified session; administrative functions are gated on a server-sourced role, and every administrative action is written to an immutable audit log.
• Database isolation — row-level security denies all direct client access; the application connects with a server-side key only.
• Browser hardening — an enforced Content Security Policy, plus X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on all responses.
• Abuse controls — a per-user cap on concurrent in-flight build requests, idempotent billing-webhook handling, and a one-free-account-per-card check.
• Change control — every change goes through review and an automated regression and security-guard test suite before release.

Enterprise controls

For organisations, CoIntegrate provides company accounts and a dedicated company admin panel — separate from the build console:

• Company accounts & roles — members belong to a company under a defined role (Admin or Member). The company role is separate from any internal staff role; a company admin can never reach our internal operator console.
• Cross-company isolation — every company-scoped request is filtered to your organisation on the server, from an identity we resolve — never a value supplied by the browser. One company cannot see another’s members, usage, or data; we treat this as a release-blocking guarantee and test it on every change.
• Self-service administration — admins invite and remove members and change roles from the company panel, with a safeguard that prevents removing the last remaining admin.
• Company governance log — administrative actions (invites, role changes, removals) are recorded in a company-visible audit log for your own review and compliance needs.
• Shared budget, no cost exposure — a company can share one credit pool across its team; the panel shows credit usage only, never internal cost or margin figures.

AI data handling

AI completions are processed by our AI model provider. Your prompts and uploads are sent to that provider’s API solely to generate your results, and are not used to train any AI model — ours or a third party’s. Our operational telemetry records counts, timing, and outcomes only; it never stores the contents of your conversations or generated files.

Sub-processors & data location

We rely on a small set of established providers, each acting as our sub-processor:

• Managed database & authentication — conversation history and telemetry (Japan).
• AI model provider — AI completions (United States).
• Payment processor — payments, subscriptions, invoicing (United States / global).
• Content delivery & edge security — CDN, DNS, TLS, access control (global).
• Cloud hosting — the application server (Singapore).
• Email delivery — transactional email (United States).

See our Privacy Policy for details. A current list of our named sub-processors, and a Data Processing Agreement, are available on request.

On our roadmap

The following are planned or in progress. We list them here rather than imply they are already complete:

• Point-in-time backups — we currently rely on our database provider’s standard backup facilities; automated point-in-time recovery is being enabled.
• Multi-factor authentication for customer accounts.
• Corporate SSO (SAML) for enterprise customers.
• Independent penetration test and a formal SOC 2 program. We do not hold these attestations today.
• EU data residency — data is currently processed in the regions listed above; an EU-resident option is on our roadmap.
• Self-serve data export & deletion — handled on request today (see below).

Data requests & reporting a concern

To request a copy of your data, deletion of your account, or a Data Processing Agreement, email info@botlabhq.com; we action these within the applicable statutory period. If you believe you have found a security vulnerability, please report it to the same address and we will respond promptly. Please do not publicly disclose an issue until we have had a chance to address it.