Security approach
Bostic.ai is designed around organization isolation, least privilege, encrypted transport, auditable access and bounded background processing.
Tenant isolation
Core customer records are scoped by organization and related project or website context. Authorization is evaluated before organization-scoped data is returned.
External URL safety
Submitted website and sitemap targets are validated at backend boundaries. Runtime fetch systems must also validate DNS resolution and redirect targets, blocking private or reserved destinations after resolution.
Job and queue safety
Dedicated SEO work lanes, active-job safeguards, stale-work recovery and tenant-aware admission help prevent duplicate or permanently blocking work.
Sensitive output
Frontend-facing job responses are designed to avoid raw stack traces, provider payloads, credentials, signed URLs and private internal paths.
Responsible disclosure
Security concerns may be sent to security@bostic.ai. Do not include active credentials or unnecessary customer data in the initial message.