Trust starts with
transparency.
This page describes how we actually run the Badex platform today: our infrastructure, our controls and our commitments. What is not in place yet is marked as roadmap.
How we operate.
Figures as of November 4, 2026, reviewed with every update of this page.
Our Security Pillars
Defense in Depth
Public traffic reaches our applications only through Cloudflare (WAF, DDoS protection, TLS). Servers have no public administration interfaces: administration happens only over a private, authenticated network with SSH keys.
Identity & Access
Microsoft Entra ID (Microsoft 365) with multi-factor authentication for administrator accounts. Personal, named accounts only, least privilege, and a monitored inventory of server access keys.
Continuous Monitoring
Wazuh security monitoring on every server, uptime checks every 60 seconds, server metrics and central logs. Critical alerts reach the on-call engineer within minutes, by message and phone call.
Vulnerability Management
Wazuh vulnerability detection and CIS configuration assessment on all servers. Security updates are applied regularly; host updates are done in planned maintenance windows.
GDPR
Production data is hosted in the EU (Germany) and backups are stored in the EU. Encryption in transit (TLS). A Data Processing Agreement is available on request.
Microsoft 365 Integration
Badex Signature connects to Microsoft 365 through the Microsoft identity platform (OAuth 2.0) and Microsoft Graph, with the permissions your administrator grants through Microsoft's consent flow.
Compliance
Badex is a small, focused Belgian company. Badex Signature is Microsoft 365 Certified. We do not hold ISO 27001 or SOC 2 certification; this Trust Center describes our controls as they are today.