Boring AIBoring AI
← Back to home
Trust

Trust Center

Encryption, least-privilege access, human checkpoints, and a full audit trail — plus every policy in one place.
The short version

Boring is built so automation can pass a security review, not dodge one. Here's how we protect your data, who we work with, and where to find every policy.

01

How we protect your data

Encryption and isolation
TLS protects data in transit. Credentials Boring stores directly use an encrypted workspace vault, and workspace data stays tenant-scoped.
Least-privilege access
Agents get only the tools and actions you grant — and you can revoke any connection instantly.
Human checkpoints
Agents can pause for feedback or missing context before continuing. Sensitive or irreversible steps still require explicit approval.
Full audit trail
Every step, input, output, and approval is recorded for review. Run and workspace summaries export as CSV.
Sensitive values screened at run boundaries
Run inputs and tool results are screened for recognizable long-lived credentials, card numbers, and punctuated US Social Security numbers before they're stored or sent to the model. Cards keep their last four. Signed-link token parameters remain usable, and ordinary contact details stay intact: they're the substance of the work.
Your data stays yours
We never sell your data, and we never train foundation models on your content.
Resilient by design
Runs are durable and resumable — retry from the failed step, and know when nothing was committed.
02

Policies & documents

DOCUMENT
Privacy Policy
What we collect, how we use it, and your rights.
Read →
DOCUMENT
Terms of Service
The rules for using Boring and its agents.
Read →
DOCUMENT
Security & Disclosure
Our scope, safe harbor, and how to report an issue.
Read →
03

Subprocessors

We rely on a small set of vendors to operate the service:

Composio — integrationsCloudflare — edge & hostingAnthropic / OpenAI — inferencePostHog — product analytics

The full list lives in our Privacy Policy.

04

Security program status

SOC 2 Type I
In progress

Control and policy work is underway. Boring has not yet received an independent SOC 2 audit report; we will update this page as the program advances.

Boring is in early access with design partners. Our public status pagereports checks against the API, database, storage, and integration catalog (cached ~30s on the API), and labels each one with what it actually measures. It reports the present moment only — we don't yet publish an incident log or uptime history — so if an incident touches your data or your runs, we also notify you directly by email.

Boring AI, Inc.legal@boringaico.comQuestions about your data? privacy@boringaico.com — we reply within 30 days.