Security & data

Question 1

Is my data encrypted at rest?

Accepted Answer

Yes. All customer data is encrypted at rest using AES-256 by Supabase Postgres and Cloudflare R2. BYOK keys use additional envelope encryption.

Question 2

Is data encrypted in transit?

Accepted Answer

Yes. Every connection uses TLS 1.2 or higher. HSTS is enabled on the canonical domain and on every customer custom domain.

Question 3

Where is my data stored?

Accepted Answer

Primary storage is in the European Union (Frankfurt and Stockholm). No customer data is replicated outside the EU without explicit consent.

Question 4

Is Blanca's Builder GDPR compliant?

Accepted Answer

Yes. Blanca's IT Professional SL acts as data processor for customer data and complies with the EU GDPR. See /trust/gdpr for the full statement.

Question 5

Is a Data Processing Agreement available?

Accepted Answer

Yes. A DPA is auto-signed when you accept the Terms. Enterprise customers can request a counter-signed PDF.

Question 6

Where is the list of subprocessors?

Accepted Answer

/trust/data-processing lists every subprocessor we use, their role and the data type they process. Changes are announced 30 days in advance.

Question 7

How are passwords stored?

Accepted Answer

Passwords are hashed by Supabase Auth using bcrypt with a per-user salt. Blanca's Builder never sees plaintext passwords.

Question 8

How do I exercise my right to erasure?

Accepted Answer

Settings, Account, Delete account starts the process. You can also email privacy@blancas-it.com for a manual request. We confirm completion within 30 days.

Question 9

How do I exercise my right to data portability?

Accepted Answer

Settings, Account, Export data produces a portable ZIP with your data in open formats (JSON, CSV, MD).

Question 10

Are penetration tests performed?

Accepted Answer

Yes. Annual third-party penetration tests cover the application and infrastructure. Summaries are available to Enterprise customers on request.

Question 11

How do I report a security vulnerability?

Accepted Answer

Email security@blancas-it.com with details. See /trust/vulnerability-disclosure for the policy and safe-harbour wording.

Question 12

What is the incident response process?

Accepted Answer

We follow a documented runbook with severity tiers, customer notification within 72 hours and a public post-mortem for SEV-1 incidents. See /trust/incidents.

Question 13

Are audit logs available to customers?

Accepted Answer

Yes. Settings, Security, Audit log shows all security-relevant events for your workspace. Enterprise customers can stream the log via webhook.

Question 14

Is single sign-on (SSO) supported?

Accepted Answer

Yes, on Enterprise plans. SAML 2.0 and OIDC are supported. SCIM provisioning is on the roadmap.

Question 15

Which user roles are available?

Accepted Answer

Owner, Admin, Member and Reviewer. Roles are stored in a separate user_roles table and checked via a security-definer function to prevent privilege-escalation bugs.

Question 16

Can I restrict access to a workspace by IP?

Accepted Answer

Yes, on Enterprise plans. Settings, Security, IP allowlist. Sign-in attempts from outside the list are blocked.

Question 17

Are API rate limits in place?

Accepted Answer

Yes. Every endpoint has per-user and per-IP limits to prevent abuse. Limits are documented in the API reference.

Question 18

Do logs contain personal data?

Accepted Answer

Logs are minimised. Request paths and timestamps are recorded; bodies and headers are not. Logs are retained for 30 days.

Question 19

Is my data used to train AI models?

Accepted Answer

No. Customer data is never used to train Managed AI models or shared with third parties for training. See the AI Policy for detail.

Question 20

What is the shared responsibility model?

Accepted Answer

Blanca's Builder secures the platform; you secure your account, content, secrets and end-users. The Trust Center pages spell this out for every domain.