Security
Each customer's operational data lives in its own database project, hosted in the EU. Each control below names its mechanism and its status, so your security team reviews evidence, not adjectives.
30-day trial with Pro capabilities · no card required
The control sheet
A security review goes faster when nothing has to be inferred. The status column says what runs today, what needs Pro and what is not available yet.
Isolation and hosting
| Control | Mechanism | Status |
|---|---|---|
| Tenant isolation | A database project per customer and a dedicated PostgreSQL database per environment | In place |
| EU hosting | Databases in AWS eu-central-1 and the application API in Google Cloud europe-west3, both in Frankfurt; backups in two EU regions. The Data API, workflow engine, AI Builder and sign-in run as Cloudflare Workers | In place |
Identity and access
| Control | Mechanism | Status |
|---|---|---|
| Sign-in protection | Verified Google sign-in or email and password, bot and disposable-email checks at sign-up, other sessions signed out when a password changes | In place |
| Multi-factor sign-in | Self-service enrollment for authenticator-app and email codes | Not yet |
| Row and field permissions | Custom roles, row filters and field rules enforced in the data layer on record reads and writes | Pro |
| Machine identities | Service Accounts with hashed, rotatable API keys, each bound to one environment and scoped to chosen roles or to admin access | Pro |
| Single sign-on and SCIM | SAML/OIDC sign-in and automated provisioning | Not yet |
Data protection
| Control | Mechanism | Status |
|---|---|---|
| Encrypted credentials | Integration secrets encrypted with AES-GCM and stored apart from workflow configuration | In place |
| QR code and webhook signing | Printed QR codes carry an HMAC signature; workflow webhooks can require an HMAC signature, basic or header authentication | In place |
| Protected deletion | Removed tables and columns archived and purge-protected for 30 days | In place |
Audit and assurance
| Control | Mechanism | Status |
|---|---|---|
| Data-change audit | The acting identity, the operation, and the before-and-after values of updated fields, written in the same transaction as the change | In place |
| Security event log | Sign-ins, new sessions, password changes and session revocations recorded for each user | In place |
| Independent certification | SOC 2 or ISO 27001 attestation | Not yet |
Control statuses as of September 2026, drawn from Bondi's infrastructure, authentication and data-layer code. Plan-dependent controls are marked.
Want to see this on your own process? Our team will walk through it with you.
Discuss your security reviewWhat it does
Every customer gets its own database project, and every environment its own dedicated PostgreSQL database and Data API worker. Your records never share a table with another company's.
Your databases run on Neon in AWS eu-central-1 and the application API on Google Cloud europe-west3, both in Frankfurt. The Data API, workflow engine, AI Builder and sign-in run as Cloudflare Workers.
People sign in with email and password or a verified Google account. Sign-up runs a bot check and blocks disposable email addresses, and changing a password signs out every other session.
Integration credentials are encrypted and kept apart from workflow configuration. Service Account API keys (Pro) are stored hashed, bound to one environment, scoped to chosen roles or to admin access, and rotatable. Printed QR codes carry an HMAC signature, and workflow webhooks can require an HMAC signature, basic or header authentication.
Inserts, updates, deletes and restores made through the Data API write an audit row in the same transaction: who made the change and, for updates, each changed field's value before and after. Rows changed by a delete cascade are not audited. The history sits in your environment's own database, beside the records it describes. Workflow runs keep a step-by-step trace.
Workflow agents have no database tool: records are read and written by the workflow steps you place around them, and the agent's HTTP tool, on by default, can be switched off for steps that need no outside calls. After the first build, AI Builder's changes to schema, screens, rules and workflows arrive as one validated plan on an approval card and apply only when the owner or administrator who asked approves that exact plan. Nine named tools act directly, and the ones that change structure, such as editing a status list, need an owner or administrator.
Under the hood
The mechanisms behind the page, for the architects and security reviewers evaluating it.
Read the technical documentationA separate Neon project for each customer, so no two customers share a database or a table. Every environment gets its own PostgreSQL database and its own Data API worker. A Development environment (Pro) is a copy-on-write branch of Production, including its business data; only run history is left out.
Access rules are enforced in Bondi's data layer, not PostgreSQL row-level security. Organization owners and administrators have full access to data in every workspace, and an admin-scoped API key has full access within the one environment it is bound to. Workflow data steps run under the workflow's own automation identity, which role, row and field rules do not limit, unless a manual launch is set to run as the person who started it. Only owners and administrators can merge and publish changes.
Integration credentials are encrypted with AES-GCM under an application key and stored separately from workflow configuration. Customer-managed keys are not offered.
Record changes made through the Data API are written to _system._data_audit in the same transaction, with the acting identity, a source code (user, restore or system today) and, for updates, each changed field's before-and-after value. The audit insert runs under a savepoint: if it fails, the failure is logged and the change still commits. Rows changed by a delete cascade or a cascade restore, values recovered from the archive, and schema cleanup are not recorded there. Workflow writes carry the source user; the actor is the workflow's automation identity or, for a manual launch set to run as the caller, that person.
Designed boundaries
Bondi holds no SOC 2 or ISO 27001 certification today. We take your security team through the architecture and each control directly.
Walk through the controls with usCSV export applies table access and row filters, but not field rules.
How access works todayYour team owns role assignment, access reviews and the configuration it approves. A Development environment (Pro) holds a copy of Production's business data, so review who works in it.
Read the security overviewAvailability
Questions buyers ask
Yes. Every customer has its own Neon database project, and every environment its own PostgreSQL database and Data API worker. Your records never share a database or a table with another company's.
Workflow agents have no database tool: records change in the data steps your team places in the workflow, under your business rules, and you decide where a run stops for a person. After the first build, AI Builder's changes to schema, screens, rules and workflows apply only after the owner or administrator who asked approves the validated plan. Nine named tools act directly, and the ones that change structure need an owner or administrator.
Our data processing agreement is published, and we take your security team through the architecture and each control directly. Bondi holds no SOC 2 or ISO 27001 certification today, and we don't present our infrastructure providers' certifications as our own.
Bondi runs as a cloud service, with a dedicated database project for every customer. There is no on-premises deployment.
Databases run in AWS eu-central-1 and the application API in Google Cloud europe-west3, both in Frankfurt, and the Data API, workflow engine, AI Builder and sign-in run as Cloudflare Workers, with files in Cloudflare R2 under an Eastern Europe location hint. Choosing another region and customer-managed keys are not offered today.
Backups are verified object by object and kept for 90 days across two EU regions. They are taken on request and before a workspace is deleted; scheduled backups and point-in-time recovery are not offered today. Removed tables and columns that still hold data are also archived and can't be purged for 30 days.
Files go to managed object storage with a size limit for each file type. Malware scanning is not offered today.
People sign in with email and password or with a verified Google account, and changing a password signs out every other session. Self-service multi-factor enrollment is not available yet. SAML/OIDC single sign-on and SCIM provisioning are not available yet; they are next on the identity roadmap.
Next step
We'll go through it with our engineering team, question by question, with the mechanism and current status behind each answer.
