Security and backups

Connections are encrypted

• The cloud app, the store and sign-in are served over encrypted HTTPS connections only.
• The cloud app is reached through Cloudflare, which refuses connections older than TLS 1.2.
• Card details are typed into the payment provider's own secure form or page. They are not sent to or kept on our servers.

Each business has its own database

• Every workspace has a separate database of its own. Your records are not mixed into a shared table with other customers' records.
• Inside your workspace, people see only what their rights allow: each user belongs to a security group, and the Administrator decides which screens and actions each group can use.
• Changes to important records are kept in an audit log that the Administrator can read.

Keys and passwords are kept out of the code

• The secrets our servers use — database passwords, payment and email keys — are held in Microsoft Azure Key Vault and placed on the servers at deployment. They are not stored in our source code.
• Sign-in to your BusinessSensor account goes through our own sign-in service. Account passwords there are stored only as salted hashes, never as text.

Backups you control

• The workspace Administrator can switch on automatic backups (Maintenance → Backup & Restore): choose the days and the time in your own time zone, and how many to keep — from 1 to 365. When first switched on it runs every day at 02:00 and keeps the last 7.
• In the cloud, backups are written to Microsoft Azure storage, separate from the database server.
• You can take a backup at any time with "Back up now", and download any backup to keep your own copy.
• Before a backup is restored over your data, a snapshot of the current data is taken automatically, so a restore can be rolled back. Manual and pre-restore snapshots are never deleted by the automatic clean-up.
• Every backup, download and restore is recorded in the backup audit log.

What we do not claim

We do not hold a security certification such as ISO 27001, and we do not publish an uptime percentage. If your organisation needs a security questionnaire answered, email info@businesssensor.com and we will answer it honestly.

Reporting a security problem

If you think you have found a weakness, email support@businesssensor.com with the details. Please do not test against other customers' workspaces — see our acceptable use policy.