How we handle your data.

Every customer runs in a dedicated workspace. Database access is scoped with row-level security so one workspace cannot read another workspace's data, even by accident. Application-level checks enforce the same boundary at the API layer.

All traffic to and from Attribufi is served over HTTPS. Data at rest is encrypted by our infrastructure providers. Secrets are stored in a managed secret store, never in application source or logs.

Attribufi supports email and Google sign-in today. Multi-factor authentication and SSO are on the roadmap for the enterprise tier. If MFA or SSO is a procurement requirement, tell us on the contact page.

We use a small number of infrastructure and AI provider subprocessors to run measurement and reporting. If you need the current list for a security review, request it via security@attribufi.com.

Raw prompt outputs are retained for as long as your workspace is active. Aggregated metrics are retained for trend reporting. On workspace deletion, we delete customer data within 30 days.

If you believe you have found a security issue, email security@attribufi.com. We acknowledge reports within two business days and will keep you updated as we investigate.