Data security measures
Last updated
Was this helpful?
Last updated
Was this helpful?
UI Bakery is SOC 2 compliant, demonstrating our commitment to maintaining the highest standards of data security and operational integrity. Through our , you can request our latest SOC reports, penetration test (pentest) reports, and details about our internal security policies.
In this article, you'll find answers to the most popular questions regarding data security measures provided by UI Bakery. You'll also find information on vulnerability management and how UI Bakery addresses the issues detected.
We do not store any data returned by your databases on our end. UI Bakery just serves as a proxy and doesn’t expose your sensitive credentials to the browser to avoid possible security breaches. We also have an , where you can be fully in control of UI Bakery and your data by securely storing it on your own Virtual Private Server (VPS).
We only store your usage metadata, like:
User data (emails, authorised user accounts)
Page views and Page URLs
Data source data (name, type of data source)
Components (types of components)
Action data (name, type of action)
To maintain the integrity and security of our software, we employ regular scanning of container images. This is a crucial step in identifying and addressing vulnerabilities. We utilize the Trivy tool, a trusted open-source vulnerability scanner, to carry out these scans. Trivy performs comprehensive scans to identify vulnerabilities, which include operating system (OS) and dependency vulnerabilities. This process helps us detect issues before they can be exploited, ensuring your applications are protected from potential threats.
At UI Bakery, we understand the urgency of addressing vulnerabilities. Our commitment to security means we have established clear response timelines to ensure the safety and integrity of our software:
Direct impact on UI Bakery - In cases where a critical vulnerability directly affects the core of UI Bakery itself, we will initiate immediate action to address the issue.
Critical vulnerabilities - Our team is dedicated to delivering a fix within 30 days from the moment a solution becomes available.
Other vulnerabilities - Non-critical vulnerabilities are addressed within 60 days of the fix becoming available.
Occasionally, security scanners may report false positives incorrectly identifying vulnerabilities with no impact on our software. Here is a list of known false positives:
If you notice any security vulnerabilities, please email us at and we'll resolve them ASAP.