Security

Accounts and access

• Sign-in is handled by Clerk, a dedicated authentication provider. We never see or store your password.
• Every project and note is checked against your account on each request. Nobody else can open your projects.
• There are no public review links or shared pages.

API keys

• Keys are shown once, when you create them. We store only a SHA-256 hash and a short prefix.
• You can set keys to expire and revoke them at any time from settings.
• A key only reaches the projects in its owner's account.

Data

• All traffic to whichbutton uses HTTPS. Database connections are encrypted in transit.
• Payments are handled by Dodo Payments. Card details never touch our servers.
• When our servers render screenshots for your agent in production, they skip localhost and private network addresses.
• The providers we rely on are listed on the Subprocessors page.

Reporting a vulnerability

Found a security issue? Email hello@whichbutton.xyz with steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and don't access other people's data or disrupt the service while testing. We don't run a paid bug bounty, but we will credit you if you'd like.

Incidents

If a breach affects your personal data, we will tell you and the relevant authorities as the law requires, including within the timelines set by the GDPR and India's DPDP Act.