Security
How we protect your code, credentials and data — the controls in place today and how to report a problem.
1. Security controls
| Control | Detail | Status |
|---|---|---|
| Encryption in transit | TLS 1.2+ on every connection; HSTS on all public endpoints. | Implemented |
| Secrets at rest | API keys and passwords hashed — never stored in plaintext. | Implemented |
| Tenant isolation | Logical separation per organization; no cross-tenant access. | Implemented |
| Authentication | Short-lived rotating sessions; TOTP 2FA and WebAuthn passkeys. | Implemented |
| Audit trail | Every agent action logged with actor, tool and permission. | Implemented |
| Backups | Daily encrypted backups with 30-day propagation on deletion. | Implemented |
Machine-readable contact: /.well-known/security.txt.
2. Network
bbasata Cloud coordinates only (board, queue, audit). Execution happens in your environment; your code stays on your machine. All traffic uses TLS. Rate limits apply to the public API. Webhooks are signature-verified with timestamp validation.
3. Authentication
Sessions use short-lived tokens with rotation. Two-factor authentication (TOTP) and passkeys (WebAuthn) are available. API keys can be scoped to read-only or read-write.
4. Vulnerability disclosure
Found a vulnerability? Email security@bbasata.com with reproduction steps. We acknowledge within 48h and triage within 7 days.
5. Compliance
bbasata is built to align with SOC 2 Type II and GDPR controls. Data processing addendums are available on request via the contact address above.