Security approach
Bostic.ai is designed around organization isolation, least privilege, encrypted transport, auditable access and bounded background processing.
Tenant isolation
Core customer records are scoped by organization and related project or website context. Authorization is evaluated before organization-scoped data is returned.
External URL safety
Submitted website and sitemap targets are validated at backend boundaries. Runtime fetch systems must also validate DNS resolution and redirect targets, blocking private or reserved destinations after resolution.
Job and queue safety
Dedicated SEO work lanes, active-job safeguards, stale-work recovery and tenant-aware admission help prevent duplicate or permanently blocking work.
Sensitive output
Frontend-facing job responses are designed to avoid raw stack traces, provider payloads, credentials, signed URLs and private internal paths.
Responsible disclosure
Security concerns may be sent to security@bostic.ai. Do not include active credentials or unnecessary customer data in the initial message.
Hosting, saved records and deletion
Different actions affect different records. Cancelling access is not a promise that all data has been erased.
Hostinger infrastructure
Bostic.ai runs its application, database and background processing on Hostinger VPS infrastructure. This identifies the hosting provider, not a guarantee that every external provider processes data in the same country. Contact privacy@bostic.ai before relying on a specific data-residency requirement.
Saved history is not a live connection
Reports, research snapshots and generated results are stored so you can revisit the evidence. Archiving a project or ending a subscription is not a full data-erasure operation. Turning off AI permissions stops future unsent processing; it does not recall earlier transmissions or remove saved results.
Request a scoped deletion
Email privacy@bostic.ai with the account or project and the records you want removed. We need to confirm your authority over that data. Backups and records needed for security, billing or legal obligations may require separate handling. We do not promise immediate deletion from every system or a single retention period for all data.