You bring us your clients, their projects, their agreements and, often, their passwords. Protecting them is part of the product. This page explains how, in plain words. To report a security problem, write to [email protected].
Your workspace is yours alone
Every company’s data lives in its own workspace, sealed off from every other one. Every database query is limited to the workspace of the person asking, and automated tests try to read and change other workspaces’ data before every release, so a mistake is caught before it reaches you.
Encryption
- In transit: every connection to Bitrack is encrypted (HTTPS), and browsers are told to always use it.
- The credentials vault: each secret is encrypted with a key that belongs to your workspace alone. Secrets are fetched one at a time, only after you confirm it’s you, and hidden again after 30 seconds.
- Connected calendars: the keys to a connected Google or Outlook calendar, and the events read from it, are stored encrypted.
- Backups: encrypted before they leave the server.
Access inside your workspace
- Roles with permissions down to each action, and data scope per person: everything, their projects, or only their own work.
- Rates, costs and budgets are left out entirely for people who shouldn’t see them, not just hidden on screen.
- Two-step sign-in with an authenticator app, which Owners can require for everyone.
- Sensitive changes ask you to confirm it’s you first, and Owners see who opened which credential and when.
- Clients only ever see their own projects in the client portal, and never your internal tasks, notes or rates.
Backups and recovery
Your data is backed up every night and before every update, encrypted, and kept off-site in a second location. Deleted items stay in your workspace’s Trash for 30 days, so mistakes can be undone. Backups age out within about 4 months.
Files and email
- Uploaded files are checked against the types your workspace allows and scanned for viruses.
- Emails your workspace sends to clients carry your brand and follow daily limits that protect your sending reputation.
Protecting the service
- Rate limits on sign-in, sign-up and every action that sends email or changes data.
- A robot check and blocking of throwaway email addresses on public forms.
- Strict browser security rules that stop other sites from loading or framing Bitrack’s pages.
- Errors are monitored with personal details removed, and our own team’s access to the servers is limited and protected by two-step sign-in.
Signatures you can rely on
Signed proposals and contracts are fingerprinted, so any later change shows, and come with a certificate of who signed, when and from which device.
Found a problem?
If you believe you’ve found a security issue, please email [email protected] with the details and give us a reasonable time to fix it before sharing it. We’ll reply, keep you updated, and thank you. Our contact is also published at /.well-known/security.txt.