Security

Data in transit

• Every page and request uses HTTPS, and browsers are told to always use HTTPS for bdclarity.com (HSTS).
• Pages are sent with security headers that stop other sites from framing them and limit browser features such as camera, microphone and location.

Accounts and access

• Sign-in is handled by our authentication provider. Passwords are never stored in plain text.
• Database access rules make each business’s data readable and editable only by that business’s owner.
• Administrators can protect their accounts with authenticator-app two-factor authentication. Once it is set up, it is required to enter the admin area.
• Administrator actions are recorded in an audit log.
• Links in sign-in and password-reset emails can only send you to pages on BD Clarity, never to another website.

Google Business Profile access

• BD Clarity asks Google only for the one permission it needs to read reviews and publish the replies you approve.
• Google access tokens are encrypted with AES-256-GCM before they are stored, are used only on our servers, and are never sent to your browser.
• The Google connection flow is protected against forgery with a single-use, server-checked code.
• You can disconnect at any time from Dashboard → Settings → Google, or remove access from your Google Account.

Customer feedback forms

• Public feedback forms are rate-limited to block spam and abuse.
• For that purpose we store only a one-way hash of a visitor’s IP address, never the address itself.
• Customers are not asked for their name, email address or phone number.

Hosting

BD Clarity runs on Cloudflare’s network, with data stored in Supabase. See our Privacy Policy for the full list of service providers.

Reporting a security issue

If you think you have found a security problem, please email hello@banaodigital.com with the details. Please give us a reasonable chance to fix it before telling others, and do not access or change data that is not yours.