Security

1. Reporting a security issue

Email support@botverse.cloudwith "Security report" in the subject. Include what you found, the steps to reproduce it, and what an attacker could do with it. We read every report and reply to the address it came from.

When testing, please:

• Use only your own account and API keys, and never access or change another customer's jobs, files or wallet
• Don't run tests that degrade the service for other customers (load tests, denial of service, mass job submission)
• Don't use social engineering, phishing or physical attacks against Botverse staff or providers
• Give us a reasonable chance to fix the issue before you disclose it publicly

We don't run a paid bug bounty. Our machine-readable contact is published at /.well-known/security.txt.

2. Incidents

If a breach affects personal data we process for you, we notify you without undue delay and in any case within 72 hours of becoming aware of it, as set out in Section 7C of the Terms. Notices go to the email address on your account.

If you think your account or an API key has been compromised, revoke the key from the dashboard right away, then email support@botverse.cloud.

3. How your data is protected

• Isolation. Every job belongs to the account that created it. Status, downloads and outputs are only returned to that account.
• Encryption. TLS for all traffic; files and database records are encrypted at rest.
• Short retention. Input and output files are deleted automatically 7 days after they are created.
• Credentials. API keys are stored as one-way hashes and shown once. Two-factor authentication is required before an account can issue keys for paid use.
• Abuse limits. Per-account request rate limits, a limit on jobs in progress at once, and a hold on each job's estimated cost until it finishes.
• Fetching your URLs. Source URLs must be public HTTPS addresses. Every redirect is checked, and private or internal network addresses are refused.

The companies that help us run Botverse are listed in the Privacy Policy. We give at least 14 days' notice by email before adding or replacing one.

Botverse does not currently hold SOC 2 or ISO 27001 certification.