Security Review

What data leaves our environment?

None. BabySOARus has no telemetry, no analytics and no usage reporting. It does not contact us when it starts, when it runs a search, or when it verifies its licence.

The only outbound calls the product makes are the ones your own code asks for, and those pass through a network policy you configure.

The daemon contacts no external host of its own. Stated in section 1 of the Privacy Policy.

Does licensing need internet access?

No. Verification is an offline Ed25519 signature check against a licence file you install. The daemon reads the licence out of the certificate and checks the signature. It does not call us, and it does not need outbound access to do it.

That is what makes air-gapped deployments work.

We say Ed25519 rather than "military-grade encryption" because you can look up what Ed25519 does.

What can the sandboxed code reach?

Guest code has no sockets and no host filesystem beyond the lookup directories it is given. Outbound HTTP is available only through the host, and only where your network policy permits it.

Each run is bounded by memory, time and instance limits, and an instance that traps is dropped rather than reused.

These are engineering controls, not a guarantee, and the licence agreement says so in section 5.4 rather than implying otherwise.

Who is responsible for the code we write?

You are, and the agreement is explicit about it. BabySOARus is an execution engine: its purpose is to run Python and WebAssembly that you supply.

We do not review, validate or endorse your code, and we have no access to it. Section 5 of the licence agreement sets out that division of responsibility in full, including the case where a sandbox or network control does not hold.

Worth reading before you deploy this, not after.

If we buy, where does our data go?

Your name, business email, company and licence record. Nothing else. They are stored in the United Kingdom, in London, and are not replicated elsewhere.

We do not store card details. Payments are handled by Stripe.

Website server logs are separate and may be processed outside the UK; section 5 of the Privacy Policy states the two separately rather than averaging them.

Who processes it?

Fly.io hosts our licensing system and this website. Upstash provides the managed Redis that system uses. Stripe processes payments. All three are named in the Privacy Policy.

All three are US-incorporated, so we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Storing data in London does not make a US processor a domestic one.

What happens if we stop paying?

Searches keep running. Your data stays reachable. Outbound network access from your code is denied, and nothing is deleted.

Section 6.3 of the licence agreement commits us not to make that more restrictive for a term already bought.