Security & Privacy

1. Overview

PugBase is private by default. Every note you create is accessible only to you and members of your workspace. Public sharing requires an explicit per-note opt-in. No note is automatically indexed for public discovery. Your data is never sold, never used to train AI, never used for advertising.

2. Encryption

In transit: TLS 1.3 on every connection (HTTPS-only enforced). At rest: AES-256 applied automatically across the database, files, and all backups. Key management: handled by a dedicated key-management service with automatic rotation. Limitation: we do not use end-to-end encryption. The server reads content only to enforce your access permissions and sync real-time edits.

3. Infrastructure

PugBase runs on enterprise cloud infrastructure certified to global standards:

• Data location: Southeast Asia region (Singapore) - your data stays in this region, never crosses continents
• Compute: auto-scaling across multiple zones (multi-AZ) for high load and failover
• Database: multi-region replication with point-in-time recovery
• Files: encrypted object storage, multi-region, with daily backups
• Authentication: Google sign-in + email/password + MFA

4. Access control

User data is gated by server-enforced access rules: • Notes readable only by members of the owning workspace • Edits restricted to owner / editor roles • Public share uses a unique UUID token - revoke instantly, URL is dead immediately • Privileged operations (e.g. payment webhooks) run only on restricted internal routes, never callable by a client PugBase employees access production data only on user request for troubleshooting. All such access is logged.

5. Data ownership & portability

You own 100% of your content:

• Export notes to Markdown anytime (no lock-in)
• Delete a note - data removed from our systems and all backups within 30 days
• Delete your account - workspaces + notes + files + billing data all wiped
• AI features use Google Gemini API - your content is NOT used to train Google's models (per Gemini API terms)
• Source files (video / PDF / Excel) are deleted after transcription completes - only the transcript text is retained

6. Sharing & permissions

Default: private. Every note starts accessible only to you and workspace members. Public share is opt-in per note: • Toggle on - the system mints a UUID token - anyone with the URL can read without login • Toggle off - the token is removed - the URL 404s instantly • Users can unpublish from the Explore feed without revoking the private share link No search engine indexing of private notes. Public notes appear in /explore only if the owner chose to publish.

7. Authentication

PugBase supports multiple sign-in methods: • Google sign-in (OAuth 2.0) • Email / password • Multi-factor authentication (MFA) • Session tokens rotate every hour For organizations needing SAML SSO, contact support@pugbase.io

8. Payment security

Every transaction runs through Stripe Checkout (Stripe-hosted page): • PugBase never stores or sees your card number • Stripe is PCI DSS Level 1 compliant • Card data is tokenized on Stripe's side before any reference returns to PugBase • We retain only customer ID and subscription metadata

9. Subprocessors

For transparency, the following companies process portions of your data on PugBase's behalf:

• An enterprise cloud provider - core infrastructure (data storage + compute)
• Google Gemini API - AI transcription + Q&A + chat
• Stripe - payment processing for Pro / Max subscriptions
• Unsplash API - cover image search proxy (no user data passed beyond the query)

10. Compliance

PugBase runs on cloud infrastructure that holds enterprise-grade certifications: • SOC 2 Type II (infrastructure layer) • ISO 27001 / 27017 / 27018 (infrastructure layer) • PCI DSS Level 1 (via Stripe) • PDPA (Thailand Personal Data Protection Act 2019) - we comply as data controller for Thai users • GDPR - for EU users, we process data as controller and honor right-to-erasure requests Important: these certifications are held by our infrastructure / payment providers at their layer. The PugBase application itself does not yet hold an independent SOC 2 audit - that's on the roadmap as we scale beyond a size where it's required.

11. Contact

Privacy / data inquiries: privacy@pugbase.io Security disclosure (vulnerability reports): security@pugbase.io DPA / Enterprise inquiries: support@pugbase.io