Security

Every record belongs to one organisation. For every request, the server checks who you are and which organisation you belong to before it reads or changes anything. A web address or form field alone is never trusted to say which business's data to show.

Owners, administrators, managers, accountants, staff, technicians, sales and read-only users see and do only what their role allows, and businesses can create custom roles. These checks run on the server. Hiding a button is never the control.

Passwords are stored only as one-way bcrypt hashes. Sign-in and sign-up attempts are rate-limited per email address and per network address to slow password guessing, using hashed counters. Sessions use encrypted tokens held in HTTP-only cookies.

Connections use HTTPS with HTTP Strict Transport Security. The site sends security headers such as X-Content-Type-Options, X-Frame-Options and a restrictive Permissions-Policy. Signed-in pages are not indexed by search engines and are not cached by shared caches.

Changes made in a workspace are recorded in an audit log. Invoices and payments are voided, not deleted, so financial history stays intact. AI features read your records and make recommendations; nothing is sent to customers or changed without a person approving it.

Our providers are listed on the Subprocessors page. We rely on them for hosting and database storage and choose them for their security practices.

We would rather be clear than reassuring. Today the service does not offer:

• two-factor sign-in or single sign-on
• a third-party security certification or published penetration-test report
• self-service export of every record type (the insights report can be exported; for anything else, email us)

If one of these matters for your business, tell us.

Email support@businesspilotos.com with the subject "Security report". Please do not post details publicly or access data that is not yours. Tell us what you found, how to reproduce it and the impact you expect. We aim to acknowledge reports within 5 business days and to keep you informed until the problem is fixed. Any way for one business to read or change another business's data, or to act beyond its role, is treated as high severity.

If we learn of a personal data breach that affects your account, we will tell you without undue delay and explain what happened and what to do.