Security
Where Better Design keeps your data, how it protects it, which companies handle it, and how to report a flaw.
Where your data lives
- The web app runs on Vercel. The API and the MCP server run on Cloudflare Workers.
- Your account and project data sit in a Neon Postgres database in the AWS
us-west-2region, in Oregon, in the United States. - Neon keeps a 6-hour restore window, so we can bring the database back to any moment in the last 6 hours.
- Every outside company that handles your data is listed at the end of this page.
How we protect accounts and keys
- Every connection to Better Design uses HTTPS.
- We hash passwords with scrypt. We never store a password in plain text.
- We store each API key as a SHA-256 hash. You can revoke a key at any time from your account.
- Only staff who sign in with a verified
@better-design.comaccount can reach the admin tools.
How we change the code
- Before a pull request merges, automated checks run the tests, build the app and scan the change for leaked secrets.
- A change to sign-in, the API, billing, secrets or the build pipeline cannot merge until a security review is recorded against that exact code.
- We track errors in production with Sentry.
How we use your content
- Our terms let us use the content you submit to improve Better Design, including to train the models that power it.
- Before content enters a training set, we remove names, email addresses, keys and other secrets. We keep training copies for no longer than 12 months.
- We do not sell your content, and we do not use it to train a model for anyone else.
What we do not have yet
- We do not hold a SOC 2 report or an ISO 27001 certificate.
- We do not offer a service level agreement or an uptime commitment.
If your review needs one of these, tell us what it asks for.
Report a security flaw
Use the contact form with the topic Security, or email [email protected]. Give us a reasonable time to fix a flaw before you disclose it. Our security.txt says the same.
Companies that handle your data
| Company | What it does for us | Data it handles |
|---|---|---|
| Neon | Main Postgres database, in Oregon, US | Account data and project data |
| Upstash | Session and rate limit cache | Session tokens and counters |
| Cloudflare | Runs the API and the MCP server, and stores private files | Request data, IP addresses, the training copies the terms describe |
| Vercel | Hosts the web app | Request data and IP addresses |
| Inngest | Runs background jobs | Project ids, job data and the prompts a job builds from |
| OpenAI | Generates design systems and components, and summarizes project notes | The prompts and project content those jobs send |
| Google Gemini API and Google Cloud | Turns search text into numbers we can compare | The search text a tool call sends |
| Google Analytics | Counts visits to the website, only after you accept analytics | Pages viewed, browser and device details, a cookie id |
| PostHog | Product analytics, only after you accept analytics | Event names, account or anonymous id, page paths |
| Bunny Fonts | Serves the web fonts in design system previews | IP address, needed to deliver the font files |
| Sentry | Error tracking | Error details, request data, user id |
| Stripe | Payments and subscriptions | Name, email address, billing address, payment details |
| Resend | Sends account, billing and contact email | Email address and the content of the email |
| Telegram | Sends internal alerts to our team | Name and email address of the account an alert is about |
| Cal.com | Books calls with us | Name, email address and the time you pick |
| Google and GitHub | Optional sign-in | Verified email address and the provider's user id |
Your account and project data are stored in the US. Other companies on this list may handle data in the US, the EU or elsewhere. Transfers out of the EU rely on standard contractual clauses or equivalent safeguards.