Data security measures

UI Bakery is SOC 2 compliant, demonstrating our commitment to maintaining the highest standards of data security and operational integrity. Through our Trust Portal, you can request our latest SOC reports, penetration test (pentest) reports, and details about our internal security policies.

In this article, you'll find answers to the most popular questions regarding data security measures provided by UI Bakery. You'll also find information on vulnerability management and how UI Bakery addresses the issues detected.

❓Is my data stored securely on UI Bakery?

We do not store any data returned by your databases on our end. UI Bakery just serves as a proxy and doesn’t expose your sensitive credentials to the browser to avoid possible security breaches. We also have an on-prem version, where you can be fully in control of UI Bakery and your data by securely storing it on your own Virtual Private Server (VPS).

❓Do you grant any security measures? Which ones?

• UI Bakery connects to your data sources only through whitelisted IPs:

52.176.109.125
20.52.252.203

• All credentials to your data sources are encrypted.

• All Cloud connections are encrypted with TLS.

• We keep detailed audit logs of all internal systems.

• UI Bakery Cloud is hosted in Azure data centers on servers that are SOC 1 and SOC 2 compliant. We also maintain data redundancy on our cloud instances via regular backups.

• For on-premise versions, we are physically unable to access any data related to your UI Bakery instance.

• We maintain an open channel of communication with security researchers to allow them to report security vulnerabilities responsibly.

❓What data does UI Bakery store?

We only store your usage metadata, like:

• User data (emails, authorised user accounts)

• Page views and Page URLs

• Data source data (name, type of data source)

• Components (types of components)

• Action data (name, type of action)

If you notice any security vulnerabilities, please email us at [email protected] and we'll resolve them ASAP.

Vulnerability Management

Scanning

To maintain the integrity and security of our software, we employ regular scanning of container images. This is a crucial step in identifying and addressing vulnerabilities. We utilize the Trivy tool, a trusted open-source vulnerability scanner, to carry out these scans. Trivy performs comprehensive scans to identify vulnerabilities, which include operating system (OS) and dependency vulnerabilities. This process helps us detect issues before they can be exploited, ensuring your applications are protected from potential threats.

Timely Response

At UI Bakery, we understand the urgency of addressing vulnerabilities. Our commitment to security means we have established clear response timelines to ensure the safety and integrity of our software:

• Direct impact on UI Bakery - In cases where a critical vulnerability directly affects the core of UI Bakery itself, we will initiate immediate action to address the issue.

• Critical vulnerabilities - Our team is dedicated to delivering a fix within 30 days from the moment a solution becomes available.

• Other vulnerabilities - Non-critical vulnerabilities are addressed within 60 days of the fix becoming available.

False positive results

Occasionally, security scanners may report false positives incorrectly identifying vulnerabilities with no impact on our software. Here is a list of known false positives:

• CVE-2016-1000027

• CVE-2020-5421