Security

Report a problem

Email [email protected] with "Security" in the subject. Please include the steps to reproduce, the URL or tool involved and what you saw. We reply by email and keep you posted until it is fixed.

Test only with your own account and data. Do not read, change or delete other people's data, do not run load or denial of service tests, and give us reasonable time to fix a problem before you share it.

The machine-readable version is at /.well-known/security.txt.

Signing in and connections

• Customers sign in with a one-time email link, not a password.
• AI assistants connect with OAuth 2.1 and PKCE (S256). You approve each connection on a consent page, can limit it to some brands, and can revoke it at any time in the dashboard.
• Access tokens last one hour and are issued for our MCP server only. Refresh tokens rotate on every use; a reused one ends the connection.
• Tokens, sign-in links and API keys are stored as hashes, never in plain text.

Your data

• Every tool finds your account from the sign-in token, never from a value the assistant sends, so one account cannot read another's data.
• An assistant receives only the answer of the tool it calls. We do not see your other conversations.
• Paid steps are quoted first and placed only after you confirm. Credits are bought on our website, by a person.
• Data is hosted in Frankfurt (DigitalOcean FRA1), with traffic over HTTPS through Cloudflare. Card payments are handled by Stripe; we do not store card numbers.
• Staff access to customer data is limited to support and operations, and opening an account's data from the admin screens is logged. See the privacy policy for what we keep and for how long.

Company

Buzz Dealer (Cyprus) Ltd, registration HE440718, Agias Filaxeos 122A, Limassol 3087, Cyprus.