Security

Last updated 14 July 2026.

Where your data lives

• All application data is hosted on Microsoft Azure in the West Europe region, whose data centers are located in the Netherlands. Data does not leave the EU.
• The database is Azure SQL Database; data is encrypted at rest by the platform (transparent data encryption) and encrypted in transit with TLS.
• All traffic is HTTPS-only: HTTP requests are redirected and HTTP Strict Transport Security (HSTS) is enabled.

Access control in the product

• Four-eyes approval is the core of the product: data changes go through draft → pending → approved, and the author of a change can never approve it themselves.
• Per-table roles separate who may enter data, who may approve it and who may only view it; designing a table's structure is a separate right again.
• Every row records who created it and who approved it, and when — the audit trail is the product, not an add-on.
• Companies are isolated from each other: users only ever see their own company's data.
• Demo environments are sandboxed per visitor and deleted automatically after 48 hours.

Application security

• Built on Django with its standard protections: CSRF tokens on every form, parameterised queries via the ORM (against SQL injection), and template auto-escaping (against XSS).
• Passwords are stored hashed and salted (PBKDF2); we cannot read them.
• Session cookies are HTTPS-only and protected against cross-site request forgery.
• The REST API is disabled for customers by default; where enabled for a pilot, it uses per-user token authentication with the same per-table permissions.
• Public forms are rate-limited and spam-protected.

Operations

• Automated database backups with point-in-time restore are provided by Azure SQL.
• Production runs with debug mode off; secrets live in the environment, not in code.
• Internal administration tools are restricted to staff accounts.

What we don't offer yet

Honesty over gloss: Bifrost is a pilot-stage product run by a small team. Today there is no single sign-on (SSO/SAML), no two-factor authentication, no SOC 2 or ISO 27001 certification, and no public status page. These are on the roadmap and pilot feedback decides their order. If one of them is a hard requirement for you, tell us — that signal is exactly what the pilot is for.

Reporting a vulnerability

If you believe you have found a security issue, please email [security contact email] with enough detail to reproduce it. We respond within [3] business days, keep you informed, and will not take legal action against good-faith research that respects our users' data.

Questions about security, or need this information for a supplier assessment? Use the contact page — the data processing agreement covers the formal commitments.