Security
Built for people who have to answer for it.
Giving a service access to your cloud account is a serious decision. This is exactly what microbuilder can reach, how it is protected, and how to take it away.
microbuilder
AI engineer team
plans and checks the work
Your keys
encrypted with AES-256-GCM
Build records
what was created, for clean removal
Your accounts, your bill
AWS
VPCs, clusters, databases, buckets
Cloudflare
DNS, tunnels, Workers, R2
Your apps
on ECS, EKS or K3s
Your AI provider
Anthropic, OpenRouter, vLLM…
Stop using microbuilder and all of it keeps running.
Access
You decide what microbuilder can touch.
Least privilege, written for you
microbuilder generates the IAM policy it needs, covering exactly the services it uses. Wildcards appear only where the service itself requires them, and the policy says why.
IAM roles instead of keys
Connect AWS through an IAM role that microbuilder assumes with an external ID unique to your connection. There is no long-lived key to leak, and you can revoke access by deleting the role.
Encrypted at rest
Cloud and AI keys are encrypted with AES-256-GCM before they are stored, decrypted only in memory for the call that needs them, and never shown again once saved.
One workspace per company
Resources belong to a workspace, and every request is checked against it. Members of one workspace cannot see another’s resources, even by guessing an address.
Operations
Safe to run, safe to stop.
Nothing left behind
Every build records what it created, so removal deletes all of it in the right order. Everything is tagged managed-by=microbuilder, and a scanner finds and removes tagged resources that no record points to.
Everything visible
Every resource is in your own AWS and Cloudflare consoles, on your own bill. Builds stream a live log, and AI calls can be traced in your own Langfuse with secrets kept out of the traces.
Your data stays with you
Monitoring is read-through: metrics stay on your collectors. Device credentials can be sealed to the collector so microbuilder cannot read them, or fetched by the collector from your own vault.
Single sign-on
Sign in through your own identity provider over OIDC, for every member of a workspace with a verified email domain, and require it so nobody signs in another way.
Payments by Stripe
Card details go straight to Stripe. microbuilder never sees or stores them.
Platform hygiene
Rate limits on every API, strict security headers, protection against requests to internal addresses from URLs customers enter, and encrypted, verified database backups.
Found a vulnerability?
Please tell us before anyone else. Use the contact form with “Security” as the topic and we will reply quickly. Please do not test against other customers’ data or accounts.
Your first environment, this afternoon.
Connect a cloud account, describe what you need, and watch it build. The free plan is free for good.
Free plan. No credit card.