Security you can actually inspect.
How we ask for access, protect what we hold, build automations that fail safely and respond if something goes wrong. No badges we have not earned.
The short version.
Four things worth knowing before you read the detail. Each clause below also starts with its own one-line summary.
We ask for the narrowest permission that does the job, through each platform’s own sharing tools.
Passwords, keys and tokens go only through your secure customer dashboard, never by email, chat or form.
Encrypted in transit, kept only as long as needed, deleted on schedule.
We do not hold SOC 2 or ISO 27001 certification and we do not claim to.
Security practices you can check.
Seven habits we apply to every build. Each one is something you can ask us to show you.
Least-privilege access
Dedicated accounts or app authorizations with the narrowest role that works. No shared logins, no owner access unless a platform leaves no alternative.
Secrets stay out of messages
Credentials are created by you in the platform, scoped, entered in your secure customer dashboard, and revoked at handover. Nothing secret travels by email, chat or form.
Encrypted connections
Every connection we make uses TLS. Data in working copies is stored encrypted and deleted 90 days after handover.
Test before touching live data
We prefer sandbox or test accounts and run with sample records first, then promote to live with your approval.
Logging and alerting
Automations log what they do and alert on failures so problems surface early and are explained in the handover document.
Fewer people, fewer risks
Only the people working on your order see its access and data. We separate credentials per client.
Incident response
A written process: contain, assess, notify affected clients within 72 hours, fix, and record what we learned.
The right way to give access.
The method depends on the platform. In every case you stay in control and can revoke access at any time.
| Platform type | How access is granted | What we ask for |
|---|---|---|
| SaaS apps with team seats (CRMs, helpdesks, spreadsheets) | Invite a dedicated user with a limited role, or authorize an app through the platform’s OAuth screen. | Only the objects and actions the automation uses. |
| Payment platforms (Stripe and similar) | Restricted API keys (entered in your dashboard) or app authorizations with specific permissions. Never your full secret key. | Read access first; write access only where the scope needs it. |
| Workspaces (Notion, Slack, Google Workspace) | Share specific pages, channels or folders with an integration or a service user. | The pages, channels or sheets involved, not the whole workspace. |
| Webhooks and endpoints | We provide an endpoint and a signing secret in your dashboard that you paste into the sending platform. | Nothing from you except pasting a value into a settings page. |
| Custom APIs | A scoped token you create and can revoke, ideally with an expiry. | A sandbox environment where it exists. |
Secure by default, not by exception.
Good security is mostly boring habits applied every time. These are ours.
Access you can revoke
Every permission is listed in your handover document with steps to revoke it.
Test before live
Sandbox first, sample records next, live data last, with your approval.
Safe by design
Duplicate protection, signature checks, rate-limit handling and error logging in every build.
Short retention
Working copies are deleted 90 days after handover.
Encrypted in transit
Every connection uses TLS.
Honest about gaps
No SOC 2 or ISO 27001, and we say so.
Our approach
Ask for less, check more, keep less for less time.
We assume any system we touch holds data that matters. Our practices follow three rules: request the minimum access, protect it while we have it, and remove it when we are done. This page describes what we do. It does not describe a certification, because we do not hold one.
Accounts and credentials
Separate, scoped, revocable.
- We use dedicated accounts or app authorizations rather than personal logins.
- Credentials entered in your dashboard are kept in an encrypted secrets manager, never in documents, chat or code.
- Multi-factor authentication is used on our own accounts.
- At handover, you rotate or revoke the credentials we used, and we remove our access.
Our workstations and tools
Basic hygiene, taken seriously.
Devices used for client work use full-disk encryption, automatic security updates, screen lock and endpoint protection. We use reputable providers for email, storage and project tracking, and restrict who can open client projects.
Building safe automations
Idempotent, logged, rate-aware and reversible where possible.
- Idempotency: retried events do not create duplicates.
- Signature checks: inbound webhooks are verified where the platform signs them.
- Rate-limit handling: we back off and queue rather than hammering an API.
- Least data: automations carry only the fields they need.
- Error handling: failures are logged and surfaced, never swallowed.
- Documentation: the handover document lists every credential, permission and failure path.
Data handling
Short retention, encrypted storage, no AI training.
Working copies of client data are kept only as long as needed to build, test and support the order, and are deleted 90 days after handover. We do not use client data to train artificial intelligence models. Files sent through the upload page are passed privately to the project team: small uploads are emailed and removed from the web server at once, and larger ones are held in a private, non-public area for up to 30 days. See the privacy policy and DPA.
Website and form protection
Layers of protection against bots and abuse.
Our forms use multiple hidden trap fields, timing checks, signed single-use tokens, same-origin checks, rate limits per visitor and overall, duplicate-content detection, strict server-side validation, and strict file checks that confirm the real file type, block double extensions and refuse scripts. Visitor IP addresses are stored only as a one-way hash.
Incident response
Contain, assess, notify, fix, learn.
- 1
Contain
Revoke affected access and stop the cause.
Immediately - 2
Assess
Establish what data and which clients are affected.
Hours - 3
Notify
Tell affected clients and, where required, regulators.
≤ 72 h - 4
Fix and learn
Repair, review and record what changed.
Days
Certifications and limits
We are small, and we say so.
We do not currently hold SOC 2, ISO 27001 or similar certifications. If your procurement process requires them, tell us at the quote stage and we will say plainly whether we are a fit. No system is perfectly secure, and we cannot promise that incidents will never occur.
To report a security concern or vulnerability responsibly, use the contact form and choose ‘Report a problem with this website’. Please do not include exploit details beyond what is needed to reproduce the issue, and do not access data that is not yours.
Common questions about this policy.
11 short answers to what people ask most. If yours is missing, ask it and a person replies within 24 hours.
Will you ask for my password?
Only through your secure customer dashboard at boldbellows.com/customer-dashboard, never by message, form or email. Where a platform offers invitations or app authorization, we use those instead and you never share a password at all. If anyone claiming to be us asks for a password anywhere else, do not send it, and tell us.
Do you keep my data after the project?
Working copies are deleted 90 days after handover unless you ask us to remove them sooner. We keep only business records of the order, such as the receipt and agreed scope, for accounting and legal reasons.
Do you train AI on my data?
No. Your data and files are used only to build, test and support your automation, and never to train artificial intelligence models, ours or anyone else’s. This is a written commitment in our data processing agreement, and working copies are deleted 90 days after handover.
Are you SOC 2 certified?
No, and we do not claim to be. SOC 2 is a formal audit of an organization’s controls, and we have not undergone one. Instead of badges, we describe our practices openly on this page so you can judge them.
How do I report a vulnerability?
Use the contact form and choose ‘Report a problem with this website’. Describe what you found and how to reproduce it without including real personal data. We acknowledge within 24 hours, investigate and tell you what we find.
How do you store credentials?
Credentials you enter in your secure customer dashboard are kept in an encrypted secrets manager, never in documents or chat, and removed at handover. Access is limited to the people on your project, and each credential is recorded so it can be revoked.
Do you use multi-factor authentication?
Yes, on our own accounts, including email, hosting and the tools that hold client data. We also recommend it for yours and never ask you to turn it off.
Can I see what you changed?
Most platforms record actions by a user or app in an audit log. We encourage you to review it, and because we use a dedicated user or app authorization, our actions are easy to tell apart from yours.
What if a laptop is lost?
Devices use full-disk encryption, so the data on a lost laptop cannot be read, and credentials are revocable from the platform side. We rotate anything that might be affected and tell clients if their access could be involved.
Do you test for vulnerabilities?
We test our forms and pages for common issues, such as injection, cross-site scripting and upload abuse. We do not run a formal penetration-testing program, and we say so rather than imply one. Reports from researchers are welcome.
How can I report a vulnerability?
Use the contact form and choose ‘Report a problem with this website’. Please describe the problem and the steps to reproduce it, and do not include live personal data. We respond within 24 hours.
Other policies and guides.
Our policies are written to work together. These are the ones most often read alongside this page.
Questions about this policy?
Ask us in plain words and a person will answer within 24 hours. We would rather clarify than leave you guessing.