Security and trust

Architecture

Web application over HTTPS, nothing installed on customer devices. Every customer is a tenant with an isolated workspace reached at its own subdomain, with row-level security enforcing that a session can only read or write rows belonging to its own tenant — isolation enforced at the data layer, not only in application code. Production is a dedicated environment used only for paying customers, wholly separate from staging.

Access control and authentication

Role-based access with per-screen permissions set by each customer's own administrators. Multi-factor authentication is available to every user and is enforced as a mandatory step-up before high-risk operations regardless of sign-in MFA status. Production access to BundlHQ's own infrastructure is restricted to named engineering staff, protected by MFA.

Data protection

TLS 1.2 or higher in transit; AES-256 at rest for database, storage and backups. Three independent backup layers, including an encrypted off-platform copy held outside the primary hosting account, with an automated monthly restore drill.

AI features

AI features are opt-in per tenant, with three states — off by default, partial (no cost or recipe data), or full. Customers control which state applies at any time, and AI provider data is never used for model training under commercial API terms.

Monitoring and incident response

Application error monitoring and an automated security-event digest, checked against defined thresholds every four hours with push alerting. A documented incident response process aligned to the NIST Cybersecurity Framework, with severity triage and a 72-hour customer notification commitment for a confirmed incident affecting their data.

Compliance

Designed with reference to recognised frameworks across six jurisdictions — not just a US-centric set, since the same handful of ideas (patching discipline, least privilege, multi-factor authentication, tested backups) recur across every major jurisdiction's baseline. Alignment to a framework is never presented as certification.

• NIST Cybersecurity Framework 2.0 and CISA's Cross-Sector Performance Goals 2.0 (United States)
• Australian Signals Directorate Essential Eight (BundlHQ is an Australian entity)
• UK NCSC Cyber Essentials
• Singapore Cyber Essentials mark
• Canadian Centre for Cyber Security Baseline Controls
• Cloud Security Alliance Cloud Controls Matrix and OWASP Top 10 / API Security Top 10

Subprocessors

Known limitations, stated openly

• No independent SOC 2 or ISO 27001 certification of BundlHQ itself yet — planned early 2027. Infrastructure providers hold their own certifications today.
• Single sign-on and an uptime service level are enterprise options rather than standard.
• Penetration testing and an incident-response tabletop exercise are both a standing gate ahead of production go-live, and neither has been triggered yet.
• Browser security headers (CSP, HSTS) are configured and become active at production go-live.