Security

Isolation

Each project builds and runs in its own sandbox, with its own filesystem and its own database. Outbound network access from a sandbox is enforced at the network layer, not by inspecting commands. Connections are allowed only to an allowlist: platform defaults plus hosts you approve. A blocked connection is refused and shown in the IDE, where you can allow the host with one click.

Data

Every project gets its own database, named by the project id, never by its name. Secrets you add are stored encrypted at rest (AES-256-GCM) in a per-project vault. A secret scoped to production is never injected into the development sandbox. A project can be exported as one bundle: its code, a database dump, and its environment variables. Deleting your account removes your projects and destroys their sandboxes and databases.

Billing safety

Metered AI usage is prepaid: you top up a balance in advance, and we never invoice after the fact. A monthly spend cap you set bounds what can be charged to your card. Past it, metered usage pauses. The free tier is never charged: no card, no metering. AI is billed at the provider’s list price plus a published markup; the worked example is on the pricing page.

Privacy

We run first-party product and operational analytics on our own infrastructure. We do not embed third-party advertising SDKs or cross-site trackers. Raw, account-keyed analytics events are kept for approximately 90 days, then aggregated into anonymous daily statistics and deleted. The app sets one cookie, to keep you logged in.

Compliance

Our Terms of Service, Privacy Policy, and Data Processing Addendum are published. We do not currently hold SOC 2, ISO 27001, or HIPAA attestations. The plan is SOC 2 Type I through a compliance platform once Team revenue supports it, then Type II after the observation window.

GDPR: the DPA commits us to notify you of a personal data breach within 72 hours of becoming aware of it, and to give 14 days’ notice before adding a sub-processor. You can delete your account, which erases your personal data as described in the Privacy Policy. The service is not intended for protected health information, and we do not offer a HIPAA business associate agreement.

Reporting a vulnerability

Email security@molecule.dev with steps to reproduce. Do not open a public issue. We aim to acknowledge within 72 hours.