Security and data handling
You are giving us access to apps your teams have built. Here, plainly, is what BWorlds accesses, what it does with it, and what it does not do. If a question is not covered here, ask the team directly.
Our principles
- Your apps stay yours. The code, the data and the intellectual property are yours. BWorlds claims no rights over them.
- Least privilege. We request only the access the audit needs, nothing more.
- Read by default, action on explicit approval. BWorlds analyzes in read mode. No fix is applied and no code is pushed to your repositories without your explicit consent.
- Transparency. You always know what is being analyzed and why.
What BWorlds accesses
- The code of the apps you authorize us to analyze, typically the apps your employees built with AI. Nothing else.
- Your GitHub repository commits, to follow how the code evolves.
By default, BWorlds analyzes only the code and the commits. These do not contain your clients’ personal data.
Beyond that, nothing is collected, unless an employee installs the SDK and explicitly turns on error monitoring or session recording. Those features then process usage data from the app. Turning them on is always explicit and stays in your hands.
How your data is processed
To produce the audit, your apps’ code is analyzed by OpenAI’s models, under their enterprise offering. Accordingly, your data is not used to train the models.
Fixes: you stay in control
By default, BWorlds identifies the issues and shows the builder how to fix them with their AI tool: they apply the fix, publish, and BWorlds verifies it landed. Agent-applied changes are not the default path. When they are switched on for an account, each change still requires your explicit, case-by-case approval before anything is pushed to your repositories, and you can revoke access at any time.
Hosting and location
- Hosting: in the United States (Oregon) for now.
- Encryption: your data is encrypted in transit and at rest.
Retention and deletion
- Duration: your data is kept for the duration of the contract.
- Deletion: you can request deletion of your data at any time, and it is deleted at the end of the contract.
- Revocation: you cut access whenever you want, and analysis stops.
Sub-processors
BWorlds relies on a limited set of providers to operate:
- Railway infrastructure and app hosting (United States, Oregon)
- Vercel web interface hosting and publishing
- OpenAI AI code analysis (enterprise offering)
- Stripe payment processing
GDPR
Our processing follows GDPR principles: data minimization, restricted access, right to deletion. Since your data is hosted in the United States, its transfer relies on the European Commission’s Standard Contractual Clauses (SCCs). A data processing agreement (DPA) is available on request.
What we are not, at this stage
- We do not hold a SOC 2 or ISO 27001 certification today. SOC 2 Type II is in progress.
- We do not offer a sovereign or on-premise deployment, and hosting is in the United States. EU data location is on our roadmap.
- Single sign-on (SSO / SAML) and integrations with Jira, Linear or ServiceNow are set up per account on the Enterprise tier, on request.
We are running our first enterprise rollouts, and our security posture keeps strengthening. We would rather tell you where we stand than overstate it.