Security

Traffic between your browser and Bosferi is encrypted in transit (TLS). Customer data is encrypted at rest.

Sign-in runs on our own self-hosted identity service, and you can also sign in with Google. Passwords are stored there as salted hashes, never in plain text, and never in the database that holds your app data.

You can add a second step to sign-in: a code from an authenticator app, or a code sent to your email. Turn it on under Security in your account settings.

Each person has a role in their organization, and nothing in the product can be opened without signing in to an account that belongs to that organization.

Customer data is backed up on a regular schedule as part of our disaster-recovery practices.

Servers log IP address, browser and device type, timestamps, and pages requested, used for security and debugging (see the Privacy Policy's What we collect section).

If we discover or are notified of a security issue affecting your data, we will tell you and notify the relevant regulators where the law requires it.

Found a security issue? Use the dedicated security reporting option on the contact page rather than the general form. It routes differently and warns you not to include customer data, passwords, or private keys in the report itself. You can also email [email protected] directly. Please don't disclose a vulnerability publicly before we've had a chance to respond.