Security

How BayBoard protects your data

• Encryption in transit and at rest. Connections to BayBoard use TLS. Data is encrypted at rest by our cloud database and storage providers.
• Each shop’s data is designed to be scoped to that shop. BayBoard is multi-tenant. Server-side security rules are designed so each shop’s reads and writes are scoped to that shop.
• Role-based access. What an Owner/GM, Service Advisor, Foreman, or Technician can see and do is enforced on the server, not just hidden in the interface.
• Least privilege inside BayBoard. BayBoard personnel access customer data only when needed to operate or support the Service.
• Monitoring. Errors and operational events are monitored so problems surface fast.
• Careful vendors. The Service runs on Google Cloud / Firebase and Vercel, and every vendor that touches customer data is listed on our Subprocessors page.

We do not currently hold a third-party certification such as SOC 2. We are a small company and we say so plainly; what we commit to, we put in writing on this page and in the DPA.

Our data breach notification commitment

If we become aware of a Security Incident (as defined in the Data Processing Addendum) affecting your shop’s personal information, we will notify you without undue delay after we become aware, and in any event no later than 72 hours after we become aware. Unsuccessful attempts or activities that do not compromise the security of personal information — including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, and other network attacks on firewalls or networked systems — are not Security Incidents and do not trigger this notice. The notice will tell you what happened, what data and which people are affected as far as we know, what we are doing about it, and who to talk to at BayBoard. We will keep you informed as the investigation develops and give you what you reasonably need to meet your own notification obligations to your employees, your customers, or regulators.

Reporting a vulnerability

If you believe you have found a security vulnerability in BayBoard, email hello@bayboard.io with the details. We read every report. Security testing of the Service requires our prior written authorization, as described in the Acceptable Use Policy.

Data retention and deletion

Your data is retained for the life of your subscription. If you cancel, it stays exportable for 90 days after the subscription ends, and then we delete it. The full commitment is in Section 7 of the DPA.

Contact

BayBoard LLC
Jessen Perko
3773 E Cherry Creek North Dr
Denver, CO 80209
303-398-7088
Email: hello@bayboard.io

Operational and vulnerability reports go to hello@bayboard.io. Formal legal and privacy mail may be sent to the Jessen mailing address above.