Security

Every part of the workspace requires an authenticated session. Sign-in, password credentials, password recovery, and session handling are provided through our configured authentication platform, so we do not store passwords ourselves. Anonymous sign-up is not enabled, and recovery links are single-use and time limited.

• Every workspace record is scoped to an organization, and access is limited to users with an active membership in that organization.
• Isolation is enforced by server-side row-level security in the database, not by the user interface alone.
• Database triggers prevent records in one workspace from being linked to records in another, so cross-workspace referencing cannot be created through the API.
• Consultant and multi-organization users see only the workspaces where they hold an active membership, and each workspace is read under its own access rules.

Members hold roles that determine which areas they can read and change. Write permission for each functional area is evaluated server-side by a database authorization function, so a read-only or limited role cannot change records by calling the API directly. Role and membership changes are restricted to organization administrators.

Meaningful changes to compliance records write an activity event capturing the actor, the organization, the affected record, the time, and what changed. Activity events are written as the acting user, cannot be attributed to someone else, and cannot be edited or deleted through the application.

• Ingestion runs server-side; browsers never call government sources directly with workspace credentials.
• Records are retrieved from identified authoritative public government sources and stored with their source provenance and reference link.
• Duplicate suppression prevents the same publication being ingested repeatedly, including across overlapping sources.
• Every ingestion run is logged with its source, outcome, and record counts so coverage is reviewable in the product.

Scheduled synchronization endpoints require a dedicated server-side scheduler secret, verified using a constant-time comparison and rate limited. Secrets are held in server configuration and secret storage, are never shipped to the browser, and are not exposed in the application or its logs.

Workspace invitations are single-use, time limited, and verified against the invited email address. Queued notification email is restricted to active members of the workspace that generated it.

Buxbells Resources LLC does not hold, and does not claim, SOC 2, HITRUST, ISO 27001, HIPAA certification, a formal penetration-test certification, or any other third-party security attestation. We make no uptime or service-level guarantee. Buxbells is not represented as HIPAA compliant, and protected health information should not be submitted unless your organization has explicit written authorization from us. No system can be guaranteed secure.

Please report suspected vulnerabilities or security concerns to security@buxbells.com with enough detail to reproduce the issue. We ask that you avoid accessing data belonging to other organizations and give us a reasonable opportunity to respond before disclosing publicly. We do not currently operate a paid bug bounty.