An honest summary of how Hivebizz is secured. We are a small operation and this page reflects that accurately rather than implying more than we have.

What we do

Encryption in transit. All traffic over TLS.
Encryption at rest. Database and file storage encrypted by our infrastructure provider.
No passwords. We use magic links and Google sign-in, so there are no passwords to leak.
Row-level security. Database policies scope every record to its owning workspace. Your data is not reachable from another account.
No service-role keys in client code. Privileged database access happens server-side only.
Capture worker isolation. The page capture worker blocks requests to private IP ranges, loopback, and cloud metadata endpoints, and re-checks on redirects. It cannot be used to reach internal networks.
Least access. Production system access is limited to the business owner.
Secrets management. Credentials stored in environment configuration, never in the repository.

What we do not have yet

Stated plainly, because enterprise buyers will ask and we would rather you learn it here than in a procurement call.

No SOC 2 report
No ISO 27001 certification
No penetration test report
No contractual uptime SLA
No single sign-on beyond Google, no SCIM provisioning

If your procurement process requires any of these, Hivebizz is likely not a fit for your organisation yet. We will update this page if that changes.

Reporting a vulnerability

Email hello@hivebizz.com with the subject "Security". Include enough detail to reproduce.

We ask that you give us reasonable time to fix an issue before disclosing it publicly, and that you do not access other users' data, degrade the service, or run automated scanning against production while testing.

We do not currently run a paid bug bounty, but we will credit researchers who report responsibly and want to be named.

Incident response

If a breach affects your personal data, we will notify affected users and any required regulator without undue delay, and within 72 hours where GDPR applies. Notification will state what happened, what data was involved, and what we are doing about it.