Security

People trust Buildcord with their Discord bots, and those bots talk to everyone in their servers. We take that seriously. This page covers how we protect your data, how to tell us about a security problem, and how anyone who has used a bot built on Buildcord can ask for a copy of their data or have it deleted.

How we protect your data

• Bot tokens and secrets are encrypted. Each bot gets its own AES-256-GCM key, and tokens and secrets are encrypted before they're stored. Once saved, they're never shown again, not even to you.
• Bots only ask Discord for what they use. The permissions and intents a bot requests are worked out from its flows, so a bot that never reads messages never asks to.
• Bots run apart from each other. Each bot's flows run in their own environment, and on the Paid plan each bot gets its own machine.
• Sign-in without a password. You can sign in with Discord, an emailed code or a passkey. If you do set a password, we only keep a one-way hash of it.
• Encrypted in transit. Every page, API and bot endpoint is served over HTTPS, and requests from Discord are checked against Discord's signature before a bot acts on them.
• Support access is off by default. We can only look at your bots if you turn on Support access, and even then we can't see your billing, sign-in methods, credentials, secrets or collaborators.
• We keep as little as we can. Records of bot runs are kept for three days on the Free plan and thirty days on the Paid plan. Deleting a bot deletes its versions, records, stored data and secrets.
• Your data isn't for sale. We don't sell personal data, don't use it for advertising, and don't train AI models on your bots or the people who use them.

The full details, including every service we rely on to run Buildcord, are in ourPrivacy Policy.

Reporting a vulnerability

If you think you've found a security problem in Buildcord, please tell us before telling anyone else. Emailsupport@buildcord.dev with "Security report" in the subject, and include:

• what you found and where, such as the page, API route or bot feature;
• the steps to reproduce it, with any proof of concept;
• what an attacker could do with it.

In return, we'll:

• reply within three business days to confirm we've got your report;
• keep you updated while we investigate and fix it;
• let you know when it's fixed, and credit you publicly if you'd like.

In scope

• buildcord.dev, app.buildcord.dev and docs.buildcord.dev;
• the Buildcord API, sign-in, billing and the connections for AI apps;
• the infrastructure that runs bots, including anything that lets one bot or account reach another's data.

Out of scope

• how a particular bot behaves because of the way its owner built it, which you can report to the bot's owner, or to us if it breaks our Terms of Service;
• Discord itself, and other services we use, which have their own reporting programs;
• denial of service, spam, social engineering or physical attacks;
• findings from automated scanners with no demonstrated impact.

Testing in good faith

We won't take legal action against anyone who researches and reports a vulnerability in good faith under this policy. Please only test against accounts and bots you own, stop and tell us as soon as you can reach someone else's data, don't keep or share what you saw, avoid anything that would degrade the service for others, and give us a reasonable time to fix the problem before making it public. We don't currently offer paid bounties.

Your data in bots built on Buildcord

Bots built on Buildcord are made and run by their owners, not by us. When you use one, the bot's owner decides what it stores about you, and we store it on their behalf. That can include your Discord user ID and display name, the servers you used the bot in, records of what the bot did when you used it, and anything the bot saved about you, such as points, settings or form answers.

You can ask for a copy of that data, or for it to be deleted:

1. Ask the bot's owner. They're responsible for their bot and can usually answer fastest. Most bots have a support server or a contact in their profile.
2. Or ask us. If you can't reach the owner, or would rather go through us, emailsupport@buildcord.dev using one of the buttons below. Tell us your Discord username and user ID, which bot it's about and which servers you used it in.

We'll confirm you control the Discord account before acting, then pass your request to the bot's owner and help them answer it. If they don't, we'll handle it ourselves where the law allows. Either way, we aim to answer within thirty days. To find your Discord user ID, turn on Developer Mode in Discord's Advanced settings, then right-click your name and choose Copy User ID.

Your Buildcord account

If you have a Buildcord account, you can delete any bot, or your whole account, from the builder at any time. For a copy of your account data, or anything else about your privacy, write tosupport@buildcord.dev.