Security & Trust

A plain statement of the security controls CommonBench actually operates, the things it does not claim, and how to report a problem. It exists so a buyer’s risk review can be answered from a public page rather than an email thread.

Every row in § 03 names the component that implements it. Nothing on this page describes a planned control. Where a control is absent, it is listed in § 04 instead of being softened here.

Third parties that process personal data on our behalf are listed separately at /subprocessors. Data handling and retention are in the Privacy Policy.

Email privacy@commonbench.ai with subject security, including the affected URL, endpoint or component; steps to reproduce; an impact assessment (data exposure, authentication bypass, remote code execution, and so on); and your contact details for follow-up.

Please allow a reasonable window to investigate before public disclosure. Do not access other users’ data, disrupt production, or run destructive tests. We will not pursue action against good-faith research that respects those limits.

Control	Implementation
Transport security	TLS terminated at nginx, certificates via Let’s Encrypt; HSTS enabled
Session tokens	32 random bytes from the OS CSPRNG. Only the SHA-256 digest is stored, so a leaked database or backup holds no replayable credential. Sliding expiry with periodic pruning
API keys	cbk_ prefix; only the SHA-256 hash is stored
Admin authentication	scrypt password hash, separate session, lockout on repeated failures
Content Security Policy	No unsafe-inline for scripts on served HTML: each page’s inline scripts are hashed at serve time. Inline event-handler attributes are banned and the ban is enforced by a test
Other security headers	X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy
Tenant separation	Usage, conversations and shares are keyed to the account. Conversation reads are ownership-checked; feedback and timing writes are rejected when the referenced request belongs to another account
Data subject requests	Self-service export and erasure with an emailed confirmation step
Analytics consent	Default deny. No analytics or advertising tag loads before an explicit accept
Retention	Automated sweeper prunes conversations and audit records on a fixed schedule
Backups	Nightly local archives with integrity verification, optional off-site replication, and a documented restore drill
Audit trail	Chat, share, export, rating and deletion events are recorded with actor and timestamp, and pruned on the retention schedule
Change control	Pull-request checks on every change; production deploys run through a guarded script that refuses a dirty tree, verifies health afterwards, and rolls back on failure
Spend controls	A global daily model-spend cap and per-account budgets, both enforced before a request reaches the model provider

No SOC 2 and no ISO 27001 certification. Neither has been pursued or obtained. If a certification is a procurement requirement, we are not yet a fit.

No single sign-on. SAML and OIDC are not implemented. Access is by emailed magic link.

No application-level encryption of the database at rest beyond the host disk. Documented as an open item rather than described as done.

No published penetration-test schedule and no continuous third-party testing.

No warranty that output is correct. Citations are checked for existence against our corpus and are labelled verified, flagged or stripped before display. Existence is not the same as the case supporting the proposition it is cited for, and we do not claim to verify the latter. See Limitations.

Our internal playbook follows detect, contain, assess risk, notify the supervisory authority within 72 hours where required, notify affected individuals where the risk is high, remediate, and review. Contact for incidents: privacy@commonbench.ai.

CommonBench is not a law firm, is not a licensed legal practice in any jurisdiction, and does not provide legal advice. No solicitor–client or attorney–client relationship is created by using the Service, and no legal professional privilege attaches to anything you send us.

Several of the jurisdictions we cover reserve certain activities to licensed practitioners. We are obtaining written local opinions on the boundary in Hong Kong, Singapore and Australia. Those opinions are not yet in hand. Until they are, the Service is offered as research and analysis only, self-serve document drafting is blocked in the product, and drafting is available exclusively as a human-delivered service under practitioner supervision.

We would rather publish that an opinion is outstanding than imply a clearance we do not have. This section will name each opinion, its author and its date once received.

Export or erase your data from the settings panel in the product, or email privacy@commonbench.ai. A customer Data Processing Agreement is available on request with the subject “DPA request”.