Enterprise-grade security, by default

All data is encrypted both at rest and in transit. We use industry-standard AES-256 encryption for stored data, including all credentials, tokens, and sensitive configuration. Every connection to naffe.ai is protected by TLS 1.2 or higher, ensuring your data cannot be intercepted or tampered with during transmission.

• All stored credentials and tokens are encrypted with AES-256 before reaching the database
• Encryption keys are stored separately from encrypted data, managed through secure environment isolation
• All API communication is encrypted with TLS 1.2+, including internal service-to-service calls
• HTTPS is enforced across all endpoints with no exceptions

naffe.ai is built as a multi-tenant platform with strict data isolation between customers. Every data operation is scoped to the authenticated user, and our database enforces row-level access controls that prevent any cross-tenant data access, even in the event of an application-level vulnerability.

• Row-level security policies enforce strict tenant isolation at the database layer
• Published applications are isolated with per-site data boundaries
• Backend resources provisioned for your apps are scoped exclusively to your deployment
• No customer can access, query, or modify another customer's data, applications, or configuration

We use secure, session-based authentication with no plaintext password storage. All sessions are cryptographically signed and validated on every request. Rate limiting is enforced across all endpoints to prevent brute force attacks, credential stuffing, and abuse.

• Secure session management with cryptographically signed tokens
• Rate limiting on all API endpoints to prevent abuse and automated attacks
• Every API call is authenticated and authorized before processing
• No API keys are ever exposed to end users or client-side code

When you connect external services like Google, Stripe, or Slack, naffe.ai uses the industry-standard OAuth 2.0 protocol. We never see or store your passwords. You authorize access directly with the service provider, and you can revoke access at any time.

• OAuth 2.0 for all third-party service connections - we never handle your passwords
• Minimal permission scopes - we only request the access needed for the features you use
• All OAuth tokens are encrypted at rest and decrypted only at the moment of use
• Automatic token refresh with secure credential rotation
• One-click disconnect permanently deletes stored tokens

naffe.ai uses AI to generate and edit software on your behalf. We take your data privacy seriously and have strict controls around how your data interacts with AI systems.

• Your data is never used to train AI models. Our AI provider contractually guarantees that API inputs and outputs are not used for model training
• All AI interactions are proxied through our backend - no direct client-to-AI communication
• Credit-based usage metering prevents unauthorized or excessive AI consumption
• AI-generated applications are owned entirely by you - we claim no rights to your content

Our platform runs on enterprise-grade cloud infrastructure with SOC 2 Type II certified providers. We leverage the security investments and certifications of industry-leading cloud platforms to deliver a secure, reliable, and performant service.

• All infrastructure providers maintain SOC 2 Type II compliance
• Primary data storage in the European Union with encrypted backups
• Automated deployment pipeline with integrity verification
• Continuous monitoring and automated alerting for anomalous activity
• Health checks and observability across all critical service paths

When you publish an application through naffe.ai, we take steps to ensure the deployment is safe, reversible, and verified.

• Every deployment creates a versioned snapshot - you can roll back to any previous version instantly
• Staging preview lets you see exactly what will go live before publishing
• Deployment plans are checksummed and verified to prevent tampering between review and publish
• Backend provisioning uses least-privilege access policies for all database tables and storage

Our development practices are designed to prevent common security vulnerabilities and ensure the integrity of the platform.

• Automated test suite running on every code change through continuous integration
• Protection against OWASP Top 10 vulnerabilities including injection, XSS, and CSRF
• No secrets, API keys, or credentials in client-side code - all sensitive operations are server-side
• Environment-based secret management with strict access controls
• Dependency monitoring and regular security updates

naffe.ai is operated from Denmark, EU, and is built to comply with major international data protection regulations.

We welcome responsible security research. If you discover a potential security vulnerability, please report it to us so we can address it promptly.

Related Policies