Security

Website Builder Studio, a product of 1000x Digital LLC. Website Builder Studio runs on Microsite Generator, a SaaS platform by 1000x Digital LLC.
Last Updated: November 1, 2026

This page describes, in plain terms, how we protect the service and the information you trust us with, what we do if something goes wrong, and how to report a security problem to us. It describes our practices; the binding commitments are in our Terms of Service and our Data Processing Agreement.

1. HOW WE PROTECT THE SERVICE

Encryption
- Every connection to the platform and to the sites it serves uses HTTPS, so information is encrypted in transit.
- The platform's database and file storage are encrypted at rest by our infrastructure provider, Cloudflare.
- The keys and tokens you give us to connect other services, such as your CRM, are stored encrypted.

Your account
- Passwords are never stored. We keep only a salted, one-way hash of each password.
- You can sign in with a password, with a one-time link sent to your email address, or with Google. Sign-in sessions are held on our servers, and the session cookie cannot be read by scripts on the page and is sent only over HTTPS.
- Repeated sign-up and sign-in attempts are rate-limited, and our forms use bot protection.
- Only an account's owner can manage billing, cancel the subscription or delete the account. Deleting an account requires the owner's password or a code emailed to the owner.

Keeping each customer's data separate
- Every record in the platform belongs to one customer account, and every request is limited to the account that is signed in. One customer cannot see another customer's sites, inquiries or conversations. Automated tests check this separation.

Payments
- Card details are entered on Stripe's own checkout page and never reach our servers.

Infrastructure and recovery
- The platform runs on Cloudflare, in Cloudflare's data centers and under Cloudflare's physical and network security controls.
- Data is backed up, and we test that backups can be restored.
- A permanent log of account events (such as sign-ups, payments and publishing) cannot be edited or deleted, so the record of what happened on an account cannot be changed afterward.

The sites we publish for you
- Before a site publishes, it passes our automated pre-publication checks. A page with a critical failure does not publish. These checks review the structure and technical standard of the pages we generate; they are not a legal review and not a guarantee of any result.
- Published sites are served over HTTPS with browser security headers. We place no advertising or tracking scripts on them.

AI and your data
- We do not use your content or your inquiries to train AI models, and our agreements with our AI providers do not permit them to do
so. The companies that process data for us, including our AI providers, are listed at
https://app.websitebuilder.studio/subprocessors.

Certifications
- We do not hold a third-party security certification. Our infrastructure provider, Cloudflare, maintains its own certifications.
On request, we will describe our security measures to a customer in more detail, on a confidential basis.

2. IF SOMETHING GOES WRONG

We keep a written incident response plan. If we confirm a security incident that affects your personal data, we will:
- act first to contain it;
- notify you without undue delay, and within the time set in our Data Processing Agreement, by email to your account owner;
- tell you what happened, what information was involved, and what we are doing about it, as far as we know at the time; and
- give you the information you reasonably need if you must notify people who submitted forms on your sites. You decide whether and how to notify them, because they are your contacts.
Where a law requires us to notify an authority or individuals directly, we will do so.

3. VULNERABILITY DISCLOSURE POLICY

We welcome reports from security researchers and from anyone who finds a weakness in our service. This policy says what you may test, how to report, and what we promise in return.

3.1 Scope
In scope:
- app.micrositegenerator.com and app.websitebuilder.studio (the platform), using an account you created yourself;
- micrositegenerator.com and websitebuilder.studio (our marketing websites); and
- weaknesses in our platform that affect the sites we host for customers, if you find them without testing against a customer's site or data (see below).
Out of scope:
- Our customers' published sites and their content. Do not test a customer's site, form or domain without that customer's written consent. If you believe a customer's site is unsafe or abusive, report it to us instead.
- Services run by other companies, such as Cloudflare, Stripe, Google, Anthropic, OpenAI or Resend. Report those to that company under its own policy.
- Reports that only list missing best-practice headers or settings without showing a real security impact, results of automated scanners without a working example, and social engineering of our staff, customers or providers.

3.2 What we ask of you
- Use only accounts you created yourself, and use test data. Do not access, change or delete anyone else's data. If you reach someone else's data by accident, stop, do not keep a copy, and tell us in your report.
- Do only what is needed to show the problem exists.
- Do not run denial-of-service tests, flood forms or email, send spam, or do anything that slows or disrupts the service for others.
- Do not use physical attacks, phishing or other social engineering.
- Do not put malicious content on any site, and do not keep a foothold in our systems.
- Give us a reasonable time to fix the problem before you tell anyone else, and agree on a disclosure date with us.

3.3 Our commitment to you (safe harbor)
If you make a good-faith effort to follow this policy:
- we consider your research authorized, and we will not bring legal action against you or ask any authority to act against you because of it;
- we will not treat it as a breach of our Terms of Service or Acceptable Use Policy, to the extent the research needed to go beyond them, and only for the research this policy allows; and
- if someone else brings a claim against you over research done under this policy, we will make it known that your research was authorized by us.
We cannot authorize testing of systems we do not own, including customers' sites and other companies' services. If you are unsure whether something is allowed, ask us first at the address below.

3.4 How to report
Email hello@micrositegenerator.com with the subject "Security report". Please include:
- the address or part of the service affected;
- what the problem is and what someone could do with it;
- the steps to reproduce it, and any proof of concept;
- how to contact you (you may report anonymously, but then we cannot reply).
Please do not include anyone else's personal data in your report.

3.5 What happens next
- We aim to acknowledge your report within 5 business days.
- We will confirm whether we can reproduce the problem, keep you informed while we work on it, and tell you when it is fixed.
- We do not offer payment for reports. With your permission, we are glad to thank you publicly once the problem is fixed.

4. CONTACT

Security reports and questions: hello@micrositegenerator.com (subject "Security report").
By mail: 1000x Digital LLC, P.O. Box 700012, Plymouth, MI 48170-9998.
Machine-readable contact details: https://app.websitebuilder.studio/.well-known/security.txt

CHANGE HISTORY

November 1, 2026 — first published.

1000x Digital LLC, P.O. Box 700012, Plymouth, MI 48170-9998

Version 1.0