Enterprise-grade security, built in

1.Our approach

Small businesses deserve the same protection as large enterprises. Security is built into our platform from the start, not added afterward. This page describes the protections that protect BizyBusiness.com and our client portal today, and the advanced protections we build into every website and tool we create for our clients.

2.Encryption everywhere

• HTTPS on every page: all traffic to BizyBusiness.com is encrypted in transit with TLS, and HTTP Strict Transport Security (HSTS) tells browsers never to connect over an unencrypted connection.
• Encrypted database: account, business, and support records are stored in a managed PostgreSQL database that is encrypted at rest and accessed only over encrypted connections.
• Encrypted credential vault: third-party logins we manage for clients, such as social media and Google Business Profile credentials, are encrypted with AES-256-GCM authenticated encryption before they are saved. They are never shown in lists and can be revealed one at a time only by an authorized administrator.
• Private file storage: photos, videos, and documents uploaded through the client portal are stored in private, encrypted cloud storage. Files are never publicly addressable.

3.Account and sign-in protection

• Hashed passwords: passwords are never stored. Only a salted, one-way cryptographic hash is kept, so not even our staff can see your password.
• Minimum password length: accounts require passwords of at least 8 characters.
• Secure sessions: sign-in sessions use signed, HttpOnly, Secure cookies that page scripts cannot read. Sessions expire automatically after 7 days.
• Cross-site request protection: sign-in and account requests are accepted only from our own trusted origins, which blocks cross-site request forgery.
• Generic error messages: failed sign-ins do not reveal whether an email address has an account.

4.Access control

• Server-side authorization: every page, file, and action checks your session on our servers. Hiding a button is never our only protection.
• Strict data isolation: every database query is scoped to the signed-in account, so one client can never see or change another client’s business, tickets, billing, or files.
• Protected administrator role: administrator access cannot be requested or assigned through the website. It can be granted only directly by BizyBusiness.
• File ownership checks: uploaded files are served only through an authenticated route that confirms the file belongs to you before streaming it. Uploads are limited in size.

5.Application safeguards

• Injection protection: all database access uses parameterized queries, which prevent SQL injection.
• Input validation: form submissions are validated and length-limited on the server before they are stored.
• Safe website monitoring: when we check client websites for uptime, requests to private, internal, and cloud-metadata network addresses are blocked, preventing server-side request forgery.
• Security headers: every response includes headers that prevent content-type sniffing, block clickjacking by other sites, limit referrer information, and disable browser features the site does not use, such as the camera, microphone, and location.
• Secrets management: API keys and encryption secrets are stored in encrypted environment variables and are never included in code or sent to the browser.
• No stored card numbers: we never store payment card numbers. Payments are handled by a PCI-compliant payment processor.

6.Infrastructure

• Enterprise cloud hosting: our platform runs on Vercel’s global infrastructure, which includes built-in DDoS mitigation and automatic TLS certificate management.
• Managed, isolated services: the database, file storage, and application run on separate managed services with independent credentials.
• Privacy-friendly analytics: we use aggregated analytics that do not use advertising cookies or track you across other websites.

7.Advanced security built into client websites and tools

Every website, booking system, portal, and tool we build for a client includes all of the protections above, plus the following advanced protections, which are configured for each client’s plan and features:

Accounts and access

• Two-factor authentication (2FA) options for owners and staff accounts.
• Role-based permissions so staff members see only what their job requires, such as scheduling without billing access.
• Audit logs of sign-ins and important account changes.
• Automatic sign-out of idle sessions and the ability to revoke access instantly when an employee leaves.

Protection from attacks and abuse

• Web application firewall (WAF) and DDoS protection at the network edge.
• Rate limiting on sign-in, booking, estimate, and contact forms to stop password guessing and automated abuse.
• Bot and spam protection on public forms to keep fake bookings and junk leads out of your calendar.
• A strict Content Security Policy (CSP) that controls which scripts and resources may run on the site.
• Continuous dependency monitoring and prompt security patching.

Payments and customer data

• PCI-compliant, tokenized online payments. Your customers’ card numbers never touch your website or our servers.
• Private, access-controlled storage for customer photos, job files, invoices, and documents.
• Customer records isolated per business, with encrypted storage and encrypted connections.
• Data export on request, so your records are never locked away from you.

Email and text messaging

• SPF, DKIM, and DMARC email authentication on custom-domain email, which helps prevent spoofing and keeps your messages out of spam folders.
• Registered business texting with built-in consent tracking and automatic STOP and HELP handling, supporting TCPA compliance.
• Signed, single-use appointment cancellation and confirmation links that cannot be guessed or reused.

AI safeguards

• AI features run through a secure gateway on our servers. AI provider keys are never exposed to the browser.
• Only the information needed for each AI request is sent to the AI provider.
• Adjustable automation levels, with human review options for estimates, bookings, and replies before they reach your customers.
• Limits on AI usage to prevent runaway costs and abuse.

Reliability

• Automated database backups with point-in-time recovery.
• Uptime monitoring of every client website from our administrator dashboard.
• Instant rollback to the previous working version if an update causes a problem.

8.How you can help

• Use a unique password for your BizyBusiness account that you do not use anywhere else, and consider a password manager.
• Never share your password. We will never ask for it by email, text, or phone.
• Remove access promptly for employees who leave your business.
• Be cautious of emails or texts that pretend to be from us. When in doubt, sign in directly at BizyBusiness.com.

9.Reporting a security concern

If you believe you have found a security vulnerability, or you suspect unauthorized access to your account, email info@BizyBusiness.com with the subject line "Security" and as much detail as you can safely share. We will investigate promptly. Please do not access other people’s data or disrupt our services while researching an issue.

Security is an ongoing process, not a guarantee. We continuously review and improve our safeguards, and we update this page as our protections change. See our Terms of Service for the terms that govern security incidents.