Underleau security: our no-model-training commitment, current website protections, planned access controls and recovery safeguards, and how to report a vulnerability.
User data is never used for model training. That commitment applies to Underleau and to the model and provider routes we choose. Lower cost is never a reason to relax it.
Our privacy approachHere is what is present on the public website and what the production workspace must meet. We do not claim SOC 2 or ISO certification, an independent penetration test, an uptime SLA or a completed compliance audit.
The website configures a Content Security Policy, frame restrictions, MIME-sniffing protection and a referrer policy. Production deployment must preserve those headers. These safeguards do not certify an application backend.
User data is never used for model training. Every inference route must satisfy that policy at both the model and provider level; a cheaper endpoint is not an exception.
Workspace membership, tenant isolation and authorized file access must be enforced on the server. An AI response or a client-side permission selector must never grant access by itself.
Untrusted files need bounded processing and isolated parsers. App connections need scoped authorization and revocation. Consequential external writes require explicit approval, not instructions hidden in a document.
The intended stack uses Cloudflare, Supabase, OpenRouter and Stripe, with EU handling verified across relevant processing paths. A database region alone does not establish the location of inference, logs or backups. A verified provider inventory is still to be published.
Independent encrypted database and object backups, tested restores and deletion replay are required before production customer data. We do not claim that the current prototype is backed up or that unsaved canvases can be recovered.
Email hello@underleau.com with the subject "Security report". Include the affected URL or component, expected impact and minimal steps to reproduce using your own account or a harmless sample. Do not attach secrets or another person's data.
Tell us the safeguards your team needs. We will distinguish implemented controls from planned ones.