SECURITY POLICY

How we protect your data

These are the controls in place today across infrastructure, application, identity, data and operations.

Systems with Wazuh security agent

60 s

Uptime check interval

Independent off-site backup copies (EU)

Monthly

Automated restore test

Infrastructure Security

Production runs on our own virtualised servers (Proxmox) on dedicated hardware at Contabo in Germany (EU), with separate virtual machines per product
Public traffic only through Cloudflare: reverse proxy, web application firewall and DDoS protection
No public administration interfaces: server administration only over a private, authenticated network (Tailscale) with SSH keys
Host firewalls on all servers, only the ports a service needs
Security updates applied regularly; virtualisation-host updates in planned maintenance windows

Applications built on Laravel, using its protections against CSRF, cross-site scripting and SQL injection (output escaping, parameterised queries)
HTTPS everywhere, with TLS terminated at Cloudflare
Sign-in with Microsoft 365 through the Microsoft identity platform (OAuth 2.0 / OpenID Connect) where the product integrates with Microsoft 365
Customer data is scoped per customer account inside the application

Source code in private GitHub repositories under the Badex enterprise account
Application dependencies (Composer, npm) are kept up to date and reviewed for known vulnerabilities
Deployments come from version control, so every change in production is traceable and can be rolled back

Multi-factor authentication for all administrator accounts (Microsoft Entra ID / Microsoft 365)
Personal, named accounts only, with least privilege
Server access only with SSH keys; the inventory of authorised keys is monitored and changes raise an alert
Devices on the private administration network are reviewed and removed when no longer needed

Encryption in transit (TLS) between users, Cloudflare and our services
Production data hosted in the EU (Germany)
Daily backups of all production servers
Off-site copies with two independent providers in the EU (Contabo Object Storage and Microsoft Azure Storage)

Wazuh on every server: file integrity monitoring, vulnerability detection, CIS configuration assessment and log analysis
Uptime checks every 60 seconds, with confirmation before alerting to avoid false alarms
Server metrics and central logs, plus monitoring of TLS certificates and domain expiry
Central operations dashboard: incidents are prioritised and critical ones reach the on-call engineer within minutes, by message and phone call

Automated monthly restore test: a backup is restored on an isolated machine and checked
Written runbooks for the most common incidents
Configuration changes are backed up before they are applied

We appreciate responsible disclosure. Please review our vulnerability disclosure policy before reporting.