Security and trust at Boosthis
The short answer. Boosthis is operated by Veqtara Tech Company, a company registered in the Kingdom of Saudi Arabia under commercial registration number 7054832287. Your source code is never read. The toolkit installed in your application is documented field by field, and a general install of it sends nothing anywhere. 8 outside companies receive data, each named below. The Boosthis servers and the database behind them are hosted in the United States.
What Boosthis is
Boosthis measures how a developer's own project behaves while it runs — how long its pages and requests take, which queries are slow, what is failing — and shows those measurements back to the developer, along with the problems it finds in them. A toolkit runs inside the customer's application and reports to the hosted service; a dashboard, and an optional assistant, read what it reported.
That places Boosthis inside your application, which is why this page exists. The relevant questions are what that code does, what leaves your process, where it goes and who can read it. Each is answered below.
What the toolkit collects, and what it does not
The full answer is published field by field at /docs/what-boosthis-collects, generated from the kits' own disclosure record rather than written as marketing copy. The boundaries that matter to a reviewer:
- Your source code is never read. No kit opens, scans, indexes or uploads a source file, and no source text is stored on our servers.
- Request bodies, response bodies, query strings and headers are not collected and not uploaded.
- Crash reporting records a redacted code location and the error type, never a raw stack and never a value.
- A personal-data guard runs on the sending side, inside your process, and again on the receiving side. Both layers reject a batch on the first hit, so an out-of-date kit cannot bypass the guard by renaming a field.
- A general install — the toolkit with no project key — measures locally and sends nothing anywhere.
Which companies receive data
This is the whole list, generated from the same record the privacy policy renders. Boosthis sends each company the data named beside it for the purpose named beside it. This does not assert that each provider's contractual terms restrict its use to that purpose.
| Company | What it does | What reaches it | Where it is processed |
|---|---|---|---|
| Moyasar. | payments — embedded payment form and subscription charges. | card details sent directly from the browser through Moyasar's form embedded in Boosthis-hosted checkout (never to Boosthis's servers), the amount and currency of each charge, the billing name and email on the payment, the reusable payment token that makes a renewal work, and with each charge the account's id, its short reference and Boosthis's own reference for the charge; a renewal also names the plan it renews. | Kingdom of Saudi Arabia. |
| Resend. | email delivery — the account emails listed under Account data — and receiving support mail, which Google Workspace passes on to it for the support inbox. | your email address, the subject, and the body of the message; and for mail written to Boosthis that Google Workspace passes on for the support inbox, the sender's address and name, the subject, the body and any attachments. | United States. |
| OpenAI. | AI processing — answers from the Ask Boosthis assistant, and the scheduled rule-drafting pass. Two companies sit in this path: the call leaves Boosthis to an AI gateway operated by Replit, on Replit's own account and credential, and Replit passes it to OpenAI, which generates the answer. Replit is also the hosting recipient listed separately; on this path it is the intermediary, and what it can see is the call itself. | what a question to the Ask Boosthis assistant may include, by the categories the assistant section lists — your question, earlier turns of the conversation, the project's latest readings, the project's other runtimes, the project's day-by-day history, the project's alerts, what was measured about the project's problems, a timing lead, recent traces, crashes still happening, the project's structure, fixes already tried, the project's Covenant, the project's diary, your other projects' headlines, your account's state, what your page shows, the page you asked from, Boosthis's instructions, matching rule titles, and a safety identifier for your account — and, for drafting, aggregated privacy-safe signals; one short sentence a developer or their assistant wrote, where a promise or a submitted claim cannot be read by the plain word match and the account owns the project, sent once so it can be mapped onto one subject the project already measures — and, in the same call, the list it has to choose from: up to forty of that project's own subjects, each a route, problem, job or daily-reading label with the figures already measured for it, which is that project's own data and not pooled with anyone else's; separately, the text of our own rule book, which is ours rather than a customer's: rule titles, match conditions and detector patterns, plus the prescriptive fix text on the maintainer-side drafting and review calls that cannot work without it; the provider's published position for its API is that none of it is used to train AI models. | United States. Which country actually processes it is not confirmed; this is our best understanding, recorded as an understanding. |
| Replit. | hosting and the managed PostgreSQL database, and the AI gateway in front of OpenAI. | everything this document describes as stored: account data, telemetry, and the operational database as a whole. | United States. |
| Google Cloud. | backup storage — the routine encrypted database backups described under Retention. | a copy of the operational database, in a private bucket. | United States. |
| Expo. | phone notifications — passing each serious-problem notification from Boosthis to Apple's notification service, for an iPhone whose owner turned notifications on in the Boosthis phone app. | the push address of each iPhone that turned notifications on, and each notification: the kind of problem, such as "New crash in production", and an opaque reference, never a project name or anything about the problem itself; when notifications are turned on, the phone app asks Expo for that push address, handing it the phone's Apple notification address, an installation identifier and the app's identifiers, and Expo sees the network address that request comes from. | United States. |
| Apple. | phone notifications — Apple's push notification service, which delivers each notification to the iPhone it is addressed to; Boosthis reaches it only through Expo. | the Apple notification address of each iPhone that turned notifications on, which Apple issued to that phone itself, and each notification as Expo hands it over: the kind of problem and an opaque reference. | United States. Which country actually processes it is not confirmed; this is our best understanding, recorded as an understanding. |
| Google Workspace. Named on 10 October 2026, after it had already begun receiving, since 10 September 2026 at the latest. The domain's mail moved to Google Workspace in September 2026, and Google was not added to this list when it did: nobody treated the mail service as a company receiving data until 10 October 2026, when it was named. The receiving began without the notice this list promises, and the record shows it under way by 10 September 2026 at the latest. | receiving email — the mail service for the boosthis.com domain, which receives every message sent to an address there, including the support address, and passes support mail on to Resend for the support inbox. | each message sent to a boosthis.com address: the sender's address and name, the subject, the body and any attachments; a copy of each support message stays in the owner's mailbox there with no deletion schedule, and a reply written from that mailbox rather than from the app is sent through it too. | United States. Which country actually processes it is not confirmed; this is our best understanding, recorded as an understanding. |
Three destinations sit outside that list because the customer chose them rather than Boosthis: an alert webhook you configure, a chat workspace you connect, and an AI assistant you connect. Each receives what you point it at, under your own agreement with whoever operates it.
Notice before that list changes
Before another company starts receiving account data or telemetry, it is named on this page and in the privacy policy at least 14 days before it begins — unless a change has to be made sooner to keep the service running or secure, in which case it is named as soon as it takes effect. That is the period stated in the controlling terms, and this page renders the same number rather than a second copy of it.
A company named ahead shows two days beside it in the table: the day it was named, and the first day it may receive anything. No company in the table is named ahead of starting: none is waiting to receive data.
The promise above does not depend on you coming back to compare the table. Leave an address and you will be emailed when this list changes, and for nothing else.
Where data is held
- Where the service runs: the Boosthis servers and the database behind them run in the United States.
- Whether your data crosses a border: some of it does. Moyasar holds what reaches it in the Kingdom of Saudi Arabia; Resend, Replit, Google Cloud and Expo hold what reaches them in the United States; what reaches OpenAI, Apple and Google Workspace leaves the Kingdom of Saudi Arabia too, but which country processes it is not confirmed.
These are two answers to two questions, and neither one implies the other. That the service runs in the United States does not mean nothing leaves it, and that something leaves it does not mean the service runs anywhere else.
If you need your data held somewhere else:
- If your requirement is that nothing leaves your own infrastructure, the toolkit can be installed without a project key. A general install measures your application and sends nothing anywhere — there is no account, no upload and no server side to it.
- If your requirement is that data is held in a specific country, write to support@boosthis.com before you buy, naming the country, and you will get a direct answer about whether the requirement is met.
- If your requirement is knowing when the answer changes, the notice below covers it. A change to where data is held is a change to the list of companies that receive it, and that list is what the notice is about.
Every company outside the Kingdom of Saudi Arabia is on that list because a part of the service cannot be provided without it. For each one, the ground relied on and the safeguards are recorded in the transfer register named under Documents.
Who inside Boosthis can see your data
Boosthis is operated by a small team. Access to the operational database and the admin surfaces is limited to the maintainer and to named admin members, each with a role that decides what they can reach; every admin session is separate from a customer session, expires, and is revoked immediately when a role changes or a member is disabled. Every change made from an admin surface is written to an audit log.
The dashboard's assistant and the scheduled rule-drafting pass send their calls to the AI provider named in the table above. What a question to the assistant may include is listed by category in the privacy policy: your question, earlier turns of the conversation, the project's latest readings, the project's other runtimes, the project's day-by-day history, the project's alerts, what was measured about the project's problems, a timing lead, recent traces, crashes still happening, the project's structure, fixes already tried, the project's Covenant, the project's diary, your other projects' headlines, your account's state, what your page shows, the page you asked from, Boosthis's instructions, matching rule titles, and a safety identifier for your account. A call is stopped whole if it holds an email address, a telephone number, an IP address or a token, and the answer is screened again before it is shown.
Card details are entered in Moyasar's embedded form on Boosthis-hosted checkout and go directly from the browser to Moyasar; they do not reach Boosthis's servers.
Reporting a vulnerability, and what happens next
Report privately by email to support@boosthis.com with "security" in the subject. The same address is published in machine-readable form at /.well-known/security.txt, generated from the server's own contact configuration rather than typed, so the two cannot drift apart. You do not need a Boosthis account to report one.
- Acknowledgement: within 5 business days.
- Progress: you are kept updated while it is being fixed.
- Disclosure: coordinated. The request is a window of 90 days from the initial report before details are published — shorter if a fix lands quickly, longer if the issue is unusually complex.
- Credit: given in the release notes, with your consent.
- Please do not file a public issue for a security report.
An incident affecting the service's availability is posted on the status page while it is open. An incident affecting personal data is notified to the affected customers and to the supervisory authority as the privacy policy sets out.
Security practices
- A written vulnerability reporting policy, with the acknowledgement time and the disclosure window stated on this page.
- A maintained threat model covering the service's trust boundaries, its admin surfaces and its residual risks.
- A register of every outside company that receives data, with what reaches each one and where it is processed — the same record this page and the privacy policy are generated from.
- A register of every transfer outside the Kingdom of Saudi Arabia, recording the ground relied on and the safeguards, assembled for legal review.
- Automated checks that run on every change: a personal-data guard on both the sending and receiving side of telemetry, and a register of published claims that fails the build when a page promises something the code does not do.
- A public status page with the service's own health and its open incidents, and an uptime watcher that runs outside this service so an outage cannot silence its own measurement.
Documents
The documents a security review can have, and how to get each one. A document that is not published is named here with how to ask for it, rather than left off the page.
| Document | What is in it | Can you have it? |
|---|---|---|
| Data Processing Agreement. | The published agreement for customer application telemetry, incorporated into the Terms. | Published — In full at /processing. /processing |
| Companies that receive Boosthis data. | The separate recipient list and per-company processor and onward-transfer positions. | Published — In full at /subprocessors; email change notices are available on this page. /subprocessors |
| Vulnerability reporting policy. | Where to report a security problem, what happens next, the acknowledgement time, and what is in and out of scope. | Published — In full, in the section below. /trust#reporting |
| security.txt. | The machine-readable reporting address a scanner or a researcher's tooling looks for, generated from the server's own contact configuration rather than typed. | Published — At the address below. /.well-known/security.txt |
| Privacy policy. | What is collected, what is not collected, how long each thing is kept, who receives it, and every right a customer can exercise. | Published — At /privacy, with the controlling terms at /terms. /privacy |
| What the toolkit collects. | Field by field, what each kit measures inside a customer's own application and what it sends — generated from the kits' own disclosure record. | Published — At the address below. /docs/what-boosthis-collects |
| Service status and incidents. | The service's current health and its open incidents, plus an uptime measurement taken from outside the service. | Published — At the address below. /status |
| Threat model. | The service's trust boundaries, the attacker positions considered, the controls at each boundary, and the residual risks that remain. | Exists, sent on request — It is a working engineering document that names residual weaknesses and the exact controls standing in front of them, which is an inventory worth writing for a reviewer and not worth publishing to the open internet. Write to support@boosthis.com naming the document and the company you are reviewing for. It is sent by email to a named reviewer. |
| Cross-border transfer register. | Every transfer of data outside the Kingdom of Saudi Arabia, the ground relied on for each, the safeguards, and whether an in-Kingdom alternative exists. | Exists, sent on request — It is assembled for legal review and records questions that are still open, so publishing it would present an engineer's assembly as a settled legal position. Write to support@boosthis.com naming the document and the company you are reviewing for. It is sent by email to a named reviewer. |