Skip to the content
Stable Baseline
Start free

Security

Security you can rely on.

The controls that protect your workspace, made for teams whose agents work alongside them.

At a glance

  • Stored in Sydney, encrypted

    Your content is stored in Sydney and encrypted there, and every connection uses TLS.

  • Each organisation kept apart

    Access rules in the database keep your data separate, and we test them every day.

  • Scoped keys for agents

    Give each agent or tool a key limited to what it needs, and revoke it at any time.

  • Every change has a name

    History and audit for every database record, and an activity log for every connector.

  • Agents within limits

    A job never goes beyond what the person who started it could do.

  • Never trained on

    Your content is never used to train AI models, ours or anyone else's.

01

Agents, apps and AI tools reach Stable Baseline through our API and MCP server, with keys you create and limit yourself.

  • Each key is limited to the workspaces, projects and folders you choose, and to the permissions you give it, such as reading but not changing.
  • Every call is recorded against its key, so you can see what each one did, and revoke one without touching the rest.
  • Limits slow a runaway agent down before it affects anyone else.
  • Agents you set up in Stable Baseline never go beyond what the person who started a job could do, and ask for approval when you want them to.

02Pro and Enterprise

Your people can sign in through your own identity provider, so joiners and leavers are managed in one place.

  • SAML 2.0 with Microsoft Entra ID, Okta, Google Workspace or any SAML identity provider.
  • Each email domain is checked with a DNS record before its connection goes live.
  • Turn it on person by person, so you can roll it out gradually while everyone else keeps their password and two-step sign-in.
  • Existing members are linked to their current account, and owners keep a backup way in, so your organisation can't lock itself out.

03

We keep what can be attacked small, and limit how far any one failure can reach. The engineers who build Stable Baseline also own its security, so the controls grow with the product.

Every change to our code is checked for leaked secrets and for dependencies with known weaknesses, before it's saved and again before it's released. Every day, automated tests attack the live service the way an intruder would.

We collect usage information to run, secure and bill the service, never to sell or to advertise. Our Privacy Policy explains what it includes. Your content is never used to train AI models.

Our Trust Centre has the detail: where your data lives, who can see it, how AI uses it, and how long we keep it.

04

If we confirm a security incident that affects your content, we tell your organisation without undue delay, and within 48 hours of confirming it, or sooner if your Enterprise agreement says so. We keep you updated until it's resolved.

If you think something is wrong, tell us. We'd rather look into a false alarm than miss a real problem. You can check the service's health at any time on our status page.

05

If you think you've found a security problem in Stable Baseline, please email security@stablebaseline.io with what you found and how to see it. Our security.txt has the same details.

  • We acknowledge reports within 3 business days.
  • We fix confirmed problems by how serious they are: critical within 7 days, high within 30 days and medium within 90 days.
  • We keep you informed while we look into it.

Please don't look at or change other people's data, or disrupt the service. Our Terms of Service ask for our written permission before any security testing.

06

Ask us for our Data Processing Addendum, the full text of our policies, or answers to your security questionnaire at support@stablebaseline.io, or talk to us.