Security at Bleepy

Our database and uploaded files are hosted by Supabase in London, in the United Kingdom. The Bleepy application is hosted by Vercel. Emails are sent through Microsoft 365. Card payments, where an organisation takes them, are handled by Stripe.

Some providers, such as OpenAI for the optional AI features, are outside the UK. The full list of providers that process personal data for us, with what each one does, where it is and what protects the data, is on our sub-processors page.

• Each organisation has its own web address, and people sign in on their own organisation's site.
• An account belongs to one organisation. The same email address used at two organisations is two separate accounts.
• Sign-in sessions belong to the site where you signed in and are not shared with other organisations' sites.
• Every request is checked against the person's membership of that organisation, and every record and uploaded file is stored against its organisation.
• Automated checks of this separation run on every change, and we test it by hand on our test site.

All connections to Bleepy use HTTPS, and browsers are told to use only secure connections. Our hosting providers encrypt stored data at rest.

• Passwords are stored only as salted one-way hashes (bcrypt). Nobody at Bleepy can read your password.
• Passwords must meet our password policy.
• After 10 failed sign-in attempts within 5 minutes, signing in with that email on that site is blocked for 15 minutes.
• Organisation leads, organisation admins and Bleepy's platform administrators must use two-step sign-in with an authenticator app. Anyone else can turn it on in their profile.
• You stay signed in for 24 hours after you last used Bleepy, or 30 days if you choose “Remember me for 30 days”. Accounts that must use two-step sign-in cannot use “Remember me”, and must sign in again, with their two-step code, 24 hours after each sign-in.
• Signing out ends that sign-in on every device that holds a copy of it. Changing your password signs you out everywhere.

When an organisation charges for an event, payment is taken by Stripe. Card numbers go directly to Stripe. Bleepy never sees or stores them.

Our database provider backs up the database automatically every day and keeps the last 7 days. Uploaded files, such as certificates, pictures and documents, are not yet included in those backups. Point-in-time recovery is not yet switched on, and we have not yet tested a full restore. All three are planned.

Learners can download a copy of their data, and close their account, from the Privacy and data page. Our privacy notice explains what we collect, why, and how long we keep it.

Organisations considering Bleepy can ask for our data processing agreement, data protection impact assessment and answers to a security questionnaire. Use the contact form or email support@bleepy.co.uk.

Bleepy does not currently hold a security certification. We will update this page if that changes.

We welcome reports from anyone who finds a security weakness in Bleepy.

How to report. Email support@bleepy.co.uk with “Security” in the subject. Tell us what you found, where it is (the web address) and the steps to see it. Do not send passwords, other people's personal data or patient information. You can stay anonymous.

In scope: bleepy.co.uk, app.bleepy.co.uk, organisation sites at *.bleepy.co.uk, and Bleepy's own code and settings behind them.

Good-faith research. If you follow this policy, we treat your research as authorised. We will not take legal action against you or report you to the police. If anyone else does, we will say that your research was authorised. This does not cover anything beyond what you needed to show the problem, or anything that breaks other laws.

Bleepy is run by a small team. Reports are read on working days, and a serious problem is looked at as soon as it is seen.

• Fix times. From when we confirm a problem, we aim to release a fix within 2 calendar days for a critical problem, 14 days for a high one, 30 days for a medium one and 90 days for a low one. A critical problem is contained the day it is seen.
• Other people's software. If we find a security weakness in software or a service made by someone else, we report it to them privately and do not publish the details until it is fixed, or 90 days have passed, unless they agree otherwise.
• Telling organisations. If a personal data breach affects an organisation's data, or a weakness may have been used against Bleepy, we tell the organisations affected without undue delay, aiming for within 24 hours of confirming it. If we fix a critical or high weakness that could have reached an organisation's data, we tell it within 5 working days of the fix.