Trust
Security & Compliance
Security and privacy are built into BOS from the ground up — not bolted on. Here's how your data is protected and how BOS supports your compliance obligations.
Account security
- Strong passwords — a minimum length is enforced (at least 12 characters) and passwords are stored using industry-standard hashing.
- Multi-factor authentication (MFA) — add a second factor for extra protection.
- Short-lived sessions — access tokens expire quickly and refresh securely. See Authentication.
- SSO — enterprises can connect single sign-on for centralized access.
Data protection
- Encryption — data is encrypted in transit and at rest.
- Sensitive fields — personal and bank details are specially protected, and the AI applies PII masking.
- Multi-tenant isolation — each organization's data is fully separated from every other organization.
- Secrets management — credentials are kept in a dedicated secrets vault, never in plain code.
Tamper-evident audit
Every action is recorded in a hash-chained audit trail with integrity verification, so records can't be quietly altered after the fact. See Audit Trail.
DPDP Act compliance
BOS is built India-first and supports the Digital Personal Data Protection (DPDP) Act, including handling Data Subject Requests such as erasure and data portability within required timeframes.
Your data rights
You can export your data at any time and request deletion where applicable. See Data Export & Import.
Platform security
- Security headers and a strict content security policy in production.
- Rate limiting to protect against abuse.
- Controlled cross-origin access (CORS).
- Signed, verifiable webhook payloads.
Shared responsibility
BOS secures the platform; you help by using strong passwords, enabling MFA, following the principle of least privilege for roles, and handling exported data carefully.
For policy details, see our public Security, Compliance, and DPDP pages.