Trust

Service card · reviewed 2026-09-17

LetThemBuild puts several models in one room to build and check software. This page says what the room does on its own, where a person stays in control, which controls a team can set and where each one is enforced, what each model provider keeps, and how that maps to the frameworks a questionnaire names. It is written from the code and is not a certification.

What it decides on its own, and what it does not

• The room reads, writes and runs inside a workspace on the person's machine or in a discussion on our servers. Commands run under a kernel sandbox with an outbound allowlist.
• Anything that leaves the machine, changes settings, spends money, pushes, publishes or touches production asks a person first, unless a rule they wrote or a mode they chose says otherwise; a team can raise the floor and cannot lower it below what its members chose.
• No model is trained on anything here. The masks strip credentials and, when a team asks, personal data before a prompt leaves.
• Every run leaves a receipt with the commands that ran and their exit codes, and every governance action is an audit event in a published catalogue.

The controls, and where each is enforced

Mac means the member's app applies it and a member with admin rights on the machine could work around it. Server means our servers refuse on their own. Mac + Server means both.

Beside the lines a team sets, 24 kinds of audit event record floors that are on for everyone: pinned MCP tools, masked secrets, folder trust, memories reviewed, the judge's sentences, production touches, the warden, guardrails, secrets given to runs, and retention sweeps. The full catalogue is at /docs/audit-events.

What the Mac app listens on

The desktop app runs on a developer's machine, so a review asks what it exposes. Remote control dials out and opens no port; what does listen is on this machine only, or opt-in and gated, as below. Read from the code on 2026-11-07, with the file that enforces each row; a test fails the build when a listener appears in the desktop code without a row here.

What each model provider keeps

As each provider publishes it, read on the date shown. A team's keep-nothing policy routes managed seats only to endpoints that keep nothing, and a model with an exception is off for that team until an admin allows it.

How the controls map to the frameworks

The internal risk register behind this table is in the repository as docs/AI-RISK-REGISTER.md; a customer's own assessment is answered from this page and the auditor pack a team owner can download.

Personal data

• Our Data Processing Agreement is part of the Terms and applies without a signature: roles, the Standard Contractual Clauses for transfers from the EU, UK and Switzerland, breach notice within 72 hours, deletion, and audits.
• The 10 services that process customer personal data for us are listed in its Annex III, with what each receives and where.
• What we store and how to delete it is in the Privacy Policy.

Cryptography and post-quantum readiness

Where the product signs, encrypts and negotiates keys, and what a quantum computer would break — read from the code (lib/crypto-posture.ts), held to it by a test, reviewed 2026-10-07. The first threat is traffic recorded today and opened later, which breaks a key exchange and nothing else retroactively, so key exchange comes first. The edges were read with scripts/pqc-probe.mjs. Not a certification.

The migration, in the order the exposure dictates

• Hybrid key exchange on every public endpoint — done: Cloudflare's edge, confirmed by the probe.
• Hybrid key exchange on the origin leg — planned: When Fly's proxy offers ML-KEM, or by terminating TLS in the application (Node already offers it) behind a raw TCP handler.
• Post-quantum private link — planned: Replace X25519 with a hybrid X25519 + ML-KEM-768 agreement in desktop/lib/private-link.js; both devices must update, so it ships with a version in the box.
• Long-lived data at rest — done: AES-256-GCM under a versioned derivation; no change needed.
• Signatures and code signing — planned: Follow the platforms: Ed25519 entitlements to ML-DSA when Node ships it; installers when Apple and Microsoft do.

Suppliers

The ten questions a questionnaire asks, answered

Do you keep an inventory of where you use cryptography?

Yes — the table on this page, read from the code by a test, reviewed on the date shown.

Is each use classified by what a quantum computer would break?

Yes: key exchange (recorded traffic opened later), signature (forgeable later, not retroactively), symmetric and KDF (not materially weakened).

Do your public endpoints offer a hybrid post-quantum key exchange today?

Yes, every public host negotiates X25519MLKEM768 with a client that offers it; the Mac app and iOS 26 do.

Where is the key exchange still classical?

The Cloudflare-to-Fly origin leg, the device-to-device private link, and phones on iOS 17–18. Each is named above with its plan.

Can you change an algorithm without a redeploy of every record?

Secrets at rest are sealed under a versioned derivation; a new version re-seals on read and write. Signatures are per integration and swappable one at a time.

How are keys rotated?

Server secrets by versioned derivation; webhook secrets per destination; Apple's client secret by expiry every six months; platform keys by their consoles.

What about long-lived encrypted data?

At rest it is AES-256-GCM, which a quantum computer does not materially weaken. Nothing long-lived travels under a classical key exchange except the origin leg and the private link, both listed.

Are your suppliers ready?

The table on this page says what each one offers and how we know.

Is code signing post-quantum?

No; neither Apple nor Microsoft offers it yet. Installers are signed by the platform's certificate, which is forgeable only once the computer exists.

Which standards do you follow?

FIPS 203 (ML-KEM) through the hybrid X25519MLKEM768 group; AES-256-GCM, HMAC-SHA256, HKDF and scrypt as named per row. No FIPS validation is claimed.

Software supply chain and reporting

• A CycloneDX SBOM for the web app is at /api/sbom; the desktop app's is made at release time and kept beside the installers.
• Vulnerabilities go to [email protected]; the path from a report to the EU single reporting platform within 24 hours is written in docs/CRA-REPORTING.md.
• Whether the service is up, and what broke before, is at status.letthembuild.com, hosted apart from the service so it answers when the service does not, with the same incident list at /status.