Enterprise Security & Trust

Your business data is protected by industry-standard controls.

BillLaunch uses industry-standard security controls designed to protect business and customer information, enforce tenant isolation, and ensure high platform availability.

Industry-Standard Encryption

Data is encrypted at rest using AES-256 and in transit via TLS 1.3 over secure HTTPS connections across all platform components.

Strict Multi-Tenant Isolation

Every database query enforces tenant scoping (organizationId). Business data, invoices, and client lists are strictly segregated.

AI Data Privacy Guarantee

Your business notes, contracts, and financial documents are processed in ephemeral memory and NEVER used to train public AI models.

Cloud Infrastructure Redundancy

Hosted on AWS enterprise cloud infrastructure with multi-zone redundancy, automated daily backups, and DDoS mitigation.

Security & Infrastructure Governance

• Server-Side Financial Calculations: Invoice totals, tax rates, and deposit calculations are verified strictly server-side to prevent client-side manipulation.
• Secret Key Isolation: Payment API tokens, OpenRouter keys, and database credentials reside exclusively in secure server environment variables.
• Password Hashing: User credentials are salted and hashed using industry-standard bcrypt before database storage.
• Automated Off-Site Backups: Database snapshots are captured daily with point-in-time recovery capabilities to safeguard business continuity.

Responsible Disclosure & Safe Harbor

We welcome reports from security researchers and ethical hackers who help keep BillLaunch and our contractor community safe. We operate under a Safe Harbor policy and will not pursue legal action against researchers acting in good faith under these guidelines.

✅ Permitted In-Scope Testing:
  • Multi-tenant isolation & access control checks
  • Authentication & session management research
  • Server-side validation & API security testing
🚫 Out-of-Scope / Prohibited Actions:
  • Denial of Service (DDoS/Spamming) attacks
  • Social engineering or phishing targeting users/staff
  • Exfiltrating or accessing data belonging to other companies

Initial triage response SLA: Within 24 business hours.