Built by Quadratic — SOC 2 Type II certified
Trust & security
genbase holds credentials for the tools your team runs on, so the bar is simple: you should be able to verify how we protect them — not take our word for it. Company controls are audited and continuously monitored; here's the whole picture.
Certifications & monitoring
SOC 2 Type II
Quadratic, the company behind genbase, completed a SOC 2 Type II audit — the standard covering security, confidentiality, and privacy controls, assessed over time rather than at a point in time.
HIPAA
Quadratic also maintains HIPAA compliance. genbase isn't a healthcare product, but the certification reflects the bar the company's security program is held to.
Continuously monitored
Controls are monitored continuously through Vanta, not re-checked once a year. The trust center shows their live status and is where you can request the audit reports.
Certifications are held by Quadratic, the company that builds and operates genbase. Reports available via the trust center.
How genbase handles your credentials
The product asks you to connect the tools you care about. Here is exactly what happens to what you paste.
Sealed at rest
Credentials are encrypted with AES-256-GCM in a team-scoped store. Writes fail without the encryption key — there is no plaintext fallback.
The model never sees your keys
The agent's model only ever sees environment-variable names. Values are injected into the sandboxed process at runtime, never into the conversation or the model's context.
Every access is audited
Each time an automation pulls a credential, the access is written to an audit log — which app, which run, when.
Database credentials never leave our servers
PostgreSQL connections run through a proxy: the sandbox gets a short-lived, single-connection token for read-only queries — never your host or password.
Isolated, disposable computers
Every agent run executes on its own ephemeral sandboxed computer, created for that run and destroyed after it.
Verified at save, revocable anytime
An integration only shows “connected” after a real credential test. Removing it deletes the sealed values; owners can delete a whole team and all its data.
The platform underneath
Sign-in
Google sign-in via WorkOS AuthKit — no passwords for us to store.
OAuth where it counts
Slack and GitHub connect over OAuth with automatic token rotation; most other tools use scoped keys you can restrict and revoke at the source.
Infrastructure
Hosted on Vercel with data in Neon Postgres — encrypted in transit (TLS) and at rest.
Hardened surface
Rate limits on the funnel and API surfaces, security headers on every response, and usage caps on agent execution.
Security questions, answered
Is genbase itself SOC 2 certified?
genbase is built and operated by Quadratic (quadratichq.com), and the SOC 2 Type II certification covers Quadratic's security program. Audit reports and the live status of individual controls are available through the trust center at trust.quadratichq.com.
What exactly can the AI model see?
Environment-variable names, never values. When an automation needs to act in one of your apps, the credential is decrypted server-side and injected into that run's sandboxed process; the access is logged. Database integrations don't even get that far — the sandbox only receives a short-lived token for read-only queries through our proxy.
Can I delete my data?
Yes. Deleting a chat removes it (and stops any running turn). Removing an integration deletes its sealed credential values. Team owners can delete the entire team, which removes its chats, automations, integrations, and secrets.
How do I get the SOC 2 report or ask a security question?
Request reports through the trust center at trust.quadratichq.com, or email support@genbase248.com and we'll get you what your security review needs.
Running a security review? Email us or book 15 minutes and we'll walk you through it.
Try it with a scoped key
Start with a read-only or restricted credential — the agent verifies it at save, and you can revoke it anytime.