Security

How we keep your information safe

You're handing us bills, meter numbers and sometimes a read-only view of your bank. That deserves a straight answer about how it's looked after.

• Everything encrypted, both ways

  Your connection to BILLOCKS is HTTPS only. Everything stored — database rows, uploaded documents, backups — is encrypted at rest on the platform we run on.

• Documents kept private

  Uploads go to private storage in a folder of your own. Nothing is publicly reachable: opening a document creates a link that works for 60 seconds and only for you.

• One account can never read another

  Every table carries row-level rules enforced by the database itself, keyed to your signed-in identity. It isn't a filter in the app that could be bypassed — the database refuses.

• Bank connections are read-only

  We ask for account information only. There is no payment permission, so nothing connected to BILLOCKS can move money. We never see or store your banking login.

• Second factor for our own staff

  Office and admin access requires an authenticator app on top of a password. Without it, admin screens and admin data refuse to load.

• Least access, by role

  Roles live in their own table, checked by the database, and are never taken from anything a browser sends. Agents see their own customers; admin functions are separate again.

• Keys stay on the server

  Secrets and API keys are held as server-side environment values. None is ever bundled into the pages your browser downloads.

• Rate limiting

  Sensitive actions — document reads, AI extraction, data requests, sign-in — are counted and throttled, so nobody can hammer them.

• Audit logs

  Applications, switches, consents, data exports and deletions are all logged with who did what and when. You can see your own history; we keep the record so anything disputed can be traced.

• Backups

  The database is backed up continuously by the platform with point-in-time recovery, encrypted in the same way as the live data.

• Sessions that expire

  Signing in gives you a short-lived token that refreshes while you're active and stops working when you're not. Signing out ends it immediately, on that device.

• The usual web attacks

  No raw SQL is built from anything you type; every server call validates its input against a strict schema; forms are protected against cross-site posting; and content is escaped on render rather than injected as HTML.

• Dependencies kept current

  Third-party packages are scanned for known vulnerabilities and updated on a fixed cycle, with security fixes taken out of cycle.