How Ablit is run, what protects your data, and what we do not have yet. Everything on this page is checked against the live system when it is updated; where a control is planned rather than in place, it says so. Questions: security@ablit.app.
At a glance
| Area | Status |
|---|---|
| Encryption in transit | TLS 1.2+ on every public endpoint, HSTS with preload on ablit.app |
| Data location | Application in Frankfurt (Vercel, region fra1); database, workers, tool sandboxes and monitoring in Falkenstein, Germany (Hetzner) |
| Model training on your data | Never; see Data handling |
| Backups | Nightly database dumps plus daily provider snapshots, 7-day rotation |
| Credentials | Passwords: salted scrypt hashes. API keys: stored as hashes, shown once. Card data: Stripe only |
| Tool isolation | Per-conversation containers with an egress firewall that blocks private networks and cloud metadata |
| Dependency security | npm audit on production dependencies: 0 critical, 0 runtime high as of this date; Next.js at a version with no open advisories |
| Vulnerability disclosure | security.txt, security@ablit.app, see below |
| GDPR | Privacy Policy, Data handling page and a signable Data Processing Addendum with EU SCCs |
| SOC 2 / ISO 27001 | Not certified. No audit is in progress. We do not display badges we have not earned |
| Third-party penetration test | Not yet performed. Internal reviews and automated dependency audits only |
| Status page | Not yet; incidents are announced in the product's maintenance banner |
Infrastructure
- Web app and API edge: Vercel, serverless functions deployed in
fra1(Frankfurt), static assets on Vercel's global network. The API also answers atide.ablit.appthrough a gateway on our own server. - Database: PostgreSQL 18 with pgvector on a Hetzner Cloud server in Falkenstein, reached through PgBouncer over TLS. Redis on the same host for queues and short-lived state. The database host accepts connections only from our own servers and the application.
- Workers: the chat worker (cloud runs, long tasks, scheduled tasks) and the stream gateway run on a Hetzner server in the same private network.
- Tool sandboxes: the security (Kali) workspace and agent browsers run as containers on a dedicated Hetzner server, one workspace per conversation, with an egress firewall.
- Monitoring: Prometheus, Grafana, Loki and a self-hosted Bugsink error tracker on a separate operations server. Health checks run every five minutes and alert administrators by email.
- Email: Resend. Payments: Stripe. Analytics: PostHog EU, consent-gated.
Security controls in place
- Access. Servers accept SSH with keys only, from allow-listed administrator addresses enforced by the provider firewall; management panels are HTTPS-only. Application roles separate users, staff and administrators; administrator actions on accounts are logged.
- Authentication. Email and password (scrypt-hashed) or Google sign-in; sign-in attempts are rate-limited; API keys carry explicit permissions, expiry and revocation.
- Secrets. Provider keys live in environment configuration on Vercel and the worker host, never in the repository; known secret patterns are redacted from stored execution traces; API keys exist in the clear only at the moment they are shown to you.
- Network. Public endpoints are TLS-only with HSTS;
X-Content-Type-Options,X-Frame-Options,Referrer-Policy,Permissions-Policyand a framing CSP are sent on every response. Internal services (database, Redis, metrics exporters) listen on the private network only. - Isolation. Tool containers cannot reach private address space, the metadata service or our internal services; each conversation gets its own workspace.
- Backups. Nightly
pg_dumpon the database host plus Hetzner's daily server snapshot, both rotated after 7 days. - Change management. All changes go through pull requests, are built and deployed by Vercel from the main branch, and are reviewed before merge. Production dependencies are audited for known vulnerabilities and patched promptly (most recently: the Next.js 16.4.4 advisories, same day).
- Abuse and safety. A child-safety policy is enforced on every request regardless of settings, with incidents recorded and alerted to a person; abuse signals can pause an account for human review.
- Incident response. Triage, containment, notification and review; customers are notified of personal data breaches within 72 hours of us becoming aware (see the DPA).
Not in place yet
We would rather tell you than let you assume:
- No SOC 2 or ISO 27001 certification, and none in progress. If this matters for your procurement, say so at security@ablit.app; it informs when we start.
- No third-party penetration test yet. The first one is planned once the platform's current build-out settles; the report will be available under NDA from this page.
- No CSA STAR self-assessment published. We can complete a security questionnaire (CAIQ, SIG Lite or your own) on request.
- No encryption-at-rest guarantee beyond what the hosting providers apply to their storage. Database volumes are on Hetzner Cloud block storage; application-level encryption of stored content is not implemented.
- No public status page. The maintenance banner in the product and this page are the channels today.
- No formal retention jobs for execution traces; they are deleted with the account or on request, as the Privacy Policy states.
Subprocessors
Third parties that process customer data for us. Model and media providers receive only what a request needs; which one depends on the model you pick. We do not publish the provider behind each model; business customers can request the list under NDA for their DPA.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Web app and API hosting, file storage | EU (Frankfurt) for functions; global CDN for static assets; US company |
| Hetzner Online GmbH | Database, workers, tool sandboxes, monitoring servers | Germany (Falkenstein) |
| Stripe Payments Europe / Stripe Inc. | Payments, subscriptions, invoices | EU and US |
| Resend | Transactional and marketing email delivery | US |
| Google LLC | Optional sign-in with Google; Google Ads conversion measurement (consent-gated) | US |
| Meta Platforms | Advertising conversion measurement (consent-gated) | US |
| PostHog (EU cloud) | Product analytics (consent-gated) | EU |
| Brave Software | Web search for the agent | US |
| Serper | Web search for the agent | US |
| AI model and media providers | Inference for the models in the catalog; each request goes only to the provider behind the model you picked, with the prompt and context it needs and nothing about your account | US and EU; the provider list for each model is available to business customers under NDA |
Changes are posted here at least 14 days before a new sub-processor handles customer data; email security@ablit.app to be notified directly. Bugsink, Grafana, Prometheus and Loki are self-hosted on our own Hetzner servers and are not third parties.
Disclosure
If you find a vulnerability in Ablit, email security@ablit.app with the details and steps to reproduce. We acknowledge within 2 business days, keep you informed, and credit you if you want. Please do not access other people's data, degrade the service, or publish before we have fixed the issue; good-faith research that follows these rules will not lead to legal action from us. Machine-readable contact: /.well-known/security.txt.
Documents
- Privacy Policy
- Terms of Service
- Data handling
- Data Processing Addendum (countersigned copy on request)
- Security questionnaire answers, architecture overview and, once available, penetration test reports: on request under NDA at security@ablit.app
Change log
- 2 November 2026. First version of this page. Same day: Next.js patched for GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr, undici and zod updated, security headers and security.txt added.