Security
Isolation we can demonstrate.
Separation is enforced in the database, not only in application code, and the application refuses to run without it.
In place
Separating one customer from another
Isolation
Enforced at the data layer
Tenant-scoped data is separated by row-level security in the database. The runtime connects using a restricted role that cannot bypass it, and the service refuses to start if that is not true, before it accepts any request.
Access
Role and record scope
Permissions are checked per route, and record visibility is scoped to the individual, the team or the tenant according to the role.
Protecting access, traffic and logs
Authentication
Asymmetric tokens, strong hashing, MFA
Access tokens are signed with an asymmetric algorithm only, and the service will not start in production without a real key pair. Passwords are hashed with a memory-hard function. Time-based multi-factor authentication is available. Programmatic access uses expiring, hashed tokens.
Transport
Security headers
Strict transport security, frame denial, content-type pinning and a referrer policy are set at the edge.
Logging
Redacted by default
Application logs are structured and pass through a redaction layer so secrets are not written to them.
Stated up front
What we do not claim
A security review goes better when the gaps are already on the table.
No certification
BOS holds no third-party security certification or attestation today.
No published pen test
No penetration test report has been published.
No automated PITR
Automated point-in-time recovery is not in place today.
This page describes properties, not implementation. We do not publish table names, role names, endpoint paths or component versions.