Security
Security, by default.
What we do for security today, and what is still on our roadmap.
What we do today
- Traffic to your services encrypted with TLS 1.2 or higher
- TLS certificates issued and renewed automatically
- A service in one project cannot reach a service in another
- Private addresses for services and databases
- Secrets, backups and object storage encrypted at rest
- Automated daily Postgres backups on every plan
Infrastructure security
The platform runs in professionally operated data centres in the European Union. Physical security at those facilities — access control, surveillance and perimeter security — is managed by the facility operator, not by Guidal.
Servers run a hardened configuration.
Encryption
Traffic between the internet and your services is encrypted with TLS 1.2 or higher. TLS certificates are issued and renewed automatically for platform and custom domains.
Backups, object storage, your secrets and billing details such as tax IDs and addresses are encrypted at rest. Encryption at rest for database storage is on our roadmap.
Network isolation
Each project runs on its own: a service in one project cannot reach a service in another. Each project has its own resource limits.
Services and databases in a project talk over private addresses that are never exposed to the internet; you reach a database from your machine only after you sign in.
Identity and access
Sign in with email and password. GitHub sign-in is planned. SAML single sign-on is planned for Enterprise.
Organization members have roles that control what they can change.
Monitoring and incident response
Automated monitoring checks the platform continuously and alerts the team. We keep logs and metrics for every service, and audit logs of billing and subscription actions.
We keep written runbooks for the systems that can fail and alert on them automatically.
Agent guardrails
Guidal's agent tools can't delete your data or change your billing.
Data residency and compliance
Your apps and databases run in the European Union. We handle personal data in line with the Digital Personal Data Protection Act (DPDPA), 2023. We do not currently offer an India region; that is on our roadmap.
SOC 2 is on our roadmap. We have not yet completed a SOC 2 audit or an independent security assessment.
How we build securely
Secure development lifecycle
Every change ships through a pull request that must pass automated checks — static analysis, dependency auditing and secret scanning — before it can merge.
Backup and disaster recovery
Managed Postgres includes automated daily backups on every plan. Point-in-time recovery is planned for the Pro and Team plans. Backups are encrypted. Copies kept off-site are on our roadmap. We rehearse database restores.
Vulnerability management
Dependencies are scanned for known vulnerabilities in CI. We prioritise critical security fixes and patch them as fast as we can. We welcome responsible security disclosures at support@guidal.ai.
Employee security
Access to production is limited to the founding team and is removed when no longer needed.
Found a vulnerability?
We take security reports seriously. If you have found a security issue, please disclose it responsibly.
Start with a folder.
Start with a source folder or an image. Guidal runs it and gives you a URL.