Security at Badu

Last updated 11 October 2026

Badu knows a lot about you and your business: your email, your customers, your money. So we built it to keep that to itself. Here is exactly how, in plain words, including what we haven't done yet.

🖥️ Your own serverEvery customer gets a separate copy of Badu on its own server and domain.

🔒 AES-256 encryptionChats, documents, logs, passwords and keys are encrypted before they're saved.

✋ Asks before it actsNothing that can't be undone happens without your OK.

🚫 Never sold or sharedYour data isn't the product. We don't sell it, share it or use it for ads.

Your own private copy

Badu isn't one big shared system. When you buy a plan we set up your own copy on its own server, so your data is never pooled with other customers'. You can switch on Keep this Badu private and anyone who finds its address sees only a blank “This Badu is private” page.

Encryption

At rest: your chats, saved documents and activity log are encrypted with AES-256-GCM before they're written to disk, using a key that belongs only to your copy.
Passwords and keys you paste in Settings are encrypted the same way. Settings only ever shows the last few characters.
Backups are locked with a password you choose. Without it, nobody can open them, including us.
What stays readable: your notes and the people, ventures and places Badu remembers are kept readable on your own copy so it can search them quickly. They never leave your copy except when Badu uses them to answer you.

It asks before it acts

Reading and looking things up happen straight away. Anything that can't be undone waits for your approval: sending email or texts, posting on social media, payments and refunds, calendar invites, shop changes, unlocking doors or disarming alarms. Before an action reaches you, a second AI check compares it with your own rules and flags anything that looks off. Every action is logged.

Hard to trick

Emails, web pages and documents can contain hidden instructions. Badu treats everything it reads as information to weigh, never as orders. The built-in Check-up in Settings tests this on your own copy, along with other everyday behaviour, so you can see for yourself.

Access

Repeated wrong passwords are slowed down and blocked.
Each gadget or app gets its own key, which you can remove any time without touching the others.
Website chat boxes only work on the websites you list, and only share what you choose.
Webhooks are signed (HMAC-SHA256), so apps can check a message really came from your Badu.

Your data, your call

Download a full backup of everything at any time, move it to another server, or have it deleted for good. We don't use your data to train AI models.

What we haven't done yet

We'd rather be honest than impressive. Badu hasn't yet had an outside security audit or penetration test, and we don't hold SOC 2 or ISO 27001 certification. We plan to as we grow, and this page will say so when it happens.

Found a problem?

Please tell us privately using “Report a security issue” at the bottom of our home page. We'll reply quickly and credit you if you'd like.