Security and data

What your instance runs on, how credentials are stored, and what to do if a key leaks.

Batuta ships as a managed instance per customer. This page spells out what that means for isolation, credentials and your data.

Isolation

One instance per customer: your own Postgres database on your own subdomain. No data is shared with other customers, and export is always available — see below.

Credentials

  • API keys are shown once at creation and stored only as a SHA-256 hash — a database leak does not leak usable keys. Each key keeps a short visible prefix so you can recognize it in the UI.
  • Sessions are httpOnly cookies, same-site and secure in production, stored hashed like keys.
  • Roles are OWNER and MEMBER. Only owners can invite people (one-time invite link, valid for 7 days), create or revoke API keys and manage webhooks.

Export

Your data is yours: projects, cards, comments and activity are plain JSON through the same REST API the agents use. Point a script at GET /api/projects and walk from there — see REST API.

Backups

Backups follow your plan: the Team plan includes daily backups, and Business extends retention to 30 days.

If a key leaks

Revoke it immediately in Agents & keys — agents using it stop working right away. Then create a fresh key for the affected agent. Revocation takes effect on the next request; nothing else needs to change.