Security & Compliance
Data Encryption
How Babelize encrypts data: HTTPS in transit, database encryption at rest by Supabase, and AES-256-GCM for provider keys and OAuth tokens.
| Layer | How |
|---|---|
| In transit | All traffic uses HTTPS; plain HTTP is redirected to HTTPS |
| Database at rest | Encrypted at rest by our database provider, Supabase |
| AI provider keys (BYOK) and OAuth tokens, including GitHub App user tokens | Encrypted with AES-256-GCM before they are stored |
| Babelize API keys | Never stored; we keep only a SHA-256 hash and show the key once |
| CLI sign-in token | Stored on your machine in a config file readable only by your user (mode 0600) |
Questions: security@babelize.co. Full details: babelize.co/security.
Last updated: 2026-11-01
How is this guide?
Security Overview
Babelize security at a glance: where data lives, how your code is handled, secrets, access control, and how to report a vulnerability.
Access Control
Role-based access control in Babelize: the available roles, the permission matrix, sign-in methods, two-factor authentication and sessions.