Security Policy for BuiltChat

Last updated: 11 August 2026

BuiltChat is part of the BuiltSearch ecosystem. In this Security Policy, “BuiltChat”, “we”, “us”, and “our” refer to the provider of BuiltChat. We use administrative, technical, and organisational safeguards designed to protect our users, systems, and information against unauthorised access, disclosure, alteration, loss, and misuse.

This Policy provides an overview of our security approach and explains how users and security researchers can report a concern. It should be read together with our Privacy Policy and Terms of Service.

Purpose and scope

Our security programme is intended to preserve the confidentiality, integrity, and availability of the BuiltChat website, application, APIs, account systems, databases, file storage, AI workflows, and supporting infrastructure. It applies to people and service providers involved in developing, maintaining, supporting, or operating the Service.

Security is a shared responsibility. We maintain safeguards for systems under our control, our service providers secure their respective platforms, and users are responsible for protecting their accounts, devices, shared links, and the information they submit.

Security principles

Our security practices are guided by the following principles:

• Least privilege: access should be limited to what is reasonably necessary for a role or function.
• Defence in depth: multiple safeguards are used so that protection does not depend on a single control.
• Secure defaults: non-public information and sensitive operations should be restricted by default.
• Data minimisation: we seek to collect and disclose only information needed to provide and protect the Service.
• Continuous improvement: safeguards are reviewed and updated as the Service, risks, and available practices evolve.

Data protection

Data in transit

BuiltChat uses HTTPS and transport layer encryption to protect information transmitted between supported browsers or clients and our Service. Connections from BuiltChat to infrastructure and service providers are protected using the secure transport methods supported by those providers.

Data at rest

User account data, chats, projects, and uploaded files are stored using managed database and object-storage services with safeguards designed to protect stored information. Access to production data and storage systems is restricted to authorised systems and personnel with a legitimate operational need.

Complete payment credentials are handled by our payment provider rather than stored directly by BuiltChat. We retain only the billing and transaction information reasonably needed to administer subscriptions, maintain records, and provide support.

Data retention

We retain and delete information according to the purposes, safeguards, and limitations described in our Privacy Policy. Information sent to an external AI model or tool is also subject to that provider’s security and retention practices.

Authentication and account security

BuiltChat uses safeguards designed to protect account access, including:

• managed authentication and secure session handling;
• password requirements and protected password-reset flows;
• authorisation checks for authenticated application and API requests;
• time-limited or signed links where appropriate for protected file access; and
• logging or monitoring of relevant authentication and security events.

A BuiltChat account is also a BuiltSearch account and may be used across BuiltSearch services. Actions such as changing a password or ending sessions may therefore affect access to other BuiltSearch services.

Access controls

Access to non-public systems and information is limited according to job responsibilities and operational need. We use separate permissions and credentials where appropriate, restrict administrative capabilities, and review or revoke access when responsibilities change or access is no longer required.

Shared projects and links operate according to the permissions selected by users. Project owners and participants are responsible for choosing the appropriate audience, reviewing collaborators, and removing access when it is no longer needed.

Application and infrastructure security

Our development and operational practices may include:

• code review, type checking, automated validation, and testing appropriate to the change;
• dependency and platform updates to address relevant security issues;
• separation of public and authenticated functionality;
• server-side validation and authorisation for protected operations;
• restricted management of secrets, keys, and production configuration;
• logging, error monitoring, and investigation of unusual behaviour; and
• backups and recovery capabilities provided by us or our infrastructure providers.

Specific controls may vary by component and may change as we improve the Service. We do not publish sensitive architectural details that could make the Service or its users less secure.

AI models and third-party providers

BuiltChat relies on third-party providers for functions such as AI inference, web and regulatory search, cloud hosting, databases, storage, authentication, payments, email, analytics, and error monitoring. We limit the information sent to providers to what is reasonably necessary for the requested or supporting function.

Each provider is responsible for the security of its own systems. Provider safeguards, data locations, retention periods, and model-training practices may differ. Our AI model data security guide explains how data may be handled when using different models. You should review it and the applicable provider policies before sending sensitive information.

We assess providers according to factors relevant to their function and respond to provider incidents that may affect BuiltChat. However, we cannot guarantee the security, availability, or conduct of systems operated by third parties.

Monitoring and incident response

We use available logs, alerts, and provider notifications to identify operational and security issues. When we become aware of a suspected incident, we seek to assess its scope, contain the issue, preserve relevant information, restore normal operation, and reduce the likelihood of recurrence.

If an incident affects personal data, we will assess our notification obligations and notify affected users or relevant authorities where required by applicable law. Information we provide may be limited while an investigation is active or where disclosure could create additional security risk.

Business continuity and availability

BuiltChat uses managed infrastructure, backups, and recovery processes intended to support service continuity. We may perform maintenance, deploy security updates, restrict a feature, revoke sessions, or temporarily suspend access where reasonably necessary to protect users or the Service.

No system can guarantee uninterrupted availability or recovery without data loss. Availability may also depend on AI, hosting, network, authentication, and other providers outside our direct control. Service availability and support are addressed further in our Terms of Service.

Your security responsibilities

You can help protect your account and information by:

• using a strong, unique password that you do not reuse on another service;
• keeping passwords, verification codes, recovery links, and active sessions private;
• signing out on shared devices and keeping your browser, operating system, and device software updated;
• checking the recipient and permissions before sharing a chat, file, link, or project;
• avoiding untrusted links, attachments, browser extensions, and requests for credentials;
• not submitting secrets or sensitive information unless necessary and appropriate for the selected model or tool; and
• contacting us promptly if you suspect unauthorised access, data exposure, or other security issue.

BuiltChat and BuiltSearch support will never ask you to send your password or verification code by email. You are responsible for activity performed through your account except to the extent caused by our failure to use reasonable care.

Reporting a security vulnerability

If you believe you have found a vulnerability affecting BuiltChat, please email support@builtsearch.com with the subject “Security vulnerability”. Include a clear description, affected URL or feature, reproduction steps, potential impact, and any relevant screenshots or logs. Do not include passwords, access tokens, personal data, or other sensitive user information in the initial report.

When investigating or reporting a vulnerability, you must:

• act in good faith and avoid accessing, changing, downloading, or deleting another person’s data;
• use only accounts and information that you own or have explicit permission to test;
• avoid disrupting the Service, degrading availability, sending excessive traffic, or using destructive techniques;
• stop testing and report the issue if you encounter personal data, credentials, or confidential information; and
• allow us reasonable time to investigate and address the issue before making it public.

A report does not create an entitlement to payment or public recognition. We may ask for additional information so we can understand and reproduce the issue.

Prohibited security activity

The following activities are not authorised: social engineering or phishing of users or personnel; physical security testing; denial-of-service testing; automated scanning that causes excessive traffic; malware deployment; accessing another user’s account or data; extracting production data; testing third-party services outside BuiltChat’s control; and violating any applicable law or our Terms of Service.

Limitations

No internet service is completely secure. This Policy describes safeguards and practices but does not guarantee that an incident, vulnerability, data loss, or unauthorised access will never occur. It does not create warranties, certifications, service-level commitments, or contractual obligations beyond those expressly stated in our Terms of Service or another written agreement with you.

Changes to this Security Policy

We may update this Policy as our Service, providers, safeguards, and legal obligations evolve. We will post the updated version and revise the “Last updated” date. Material changes may also be communicated through the Service or by email where appropriate.

Contact us

If you have a security question, suspect unauthorised account access, or want to report a vulnerability, contact support@builtsearch.com.