Security

This page describes the controls in place today. We don't claim certifications we haven't earned; we're glad to answer your security questionnaire.

Client separation

• Each client's books live in their own company. Server-side permission rules restrict every client user to their own company's records
• A client user can belong to one client only
• Larger clients can have a dedicated environment on request

Access

• Role-based access for owners, accountants, viewers and external auditors
• Bebaak staff access is limited to the clients they are assigned to
• Access is removed when an engagement or a team member's role ends

Infrastructure

• Hosted on DigitalOcean, with HTTPS on all sites
• Server firewall limited to required traffic; SSH by key only; automatic security updates; brute-force protection
• Web applications run as restricted service users, separate from the database
• Nightly backups retained for 14 days

Working in your systems (offshore clients)

• Named logins in your systems, which you control and can revoke
• No client data on personal devices or personal email
• NDA and data-processing agreement signed before access

Reporting a problem

If you believe you've found a security issue, email siba@bebaak.co with details. We'll acknowledge within one working day.