Skip to content
Docs
Go to App

Security Overview

Infrastructure Security

Section titled “Infrastructure Security”

Bizby runs on enterprise-grade cloud infrastructure from multiple certified providers:

Google Cloud Platform (Firebase)

  • ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC 3 certified
  • Encryption by default for data at rest (AES-256) and in transit (TLS 1.2+)
  • Identity and Access Management (IAM) for fine-grained role-based access control
  • VPC isolation, DDoS protection, and continuous monitoring via Security Command Center

Cloudflare

  • ISO 27001 and SOC 2 Type II certified
  • CDN, Web Application Firewall (WAF), and DDoS protection on all endpoints
  • Real-time collaboration via Workers and Durable Objects (default path)

Fly.io (Canadian data residency path)

  • SOC 2 Type II certified, runs in ISO 27001 data centers
  • Hardware isolation via memory-safe hypervisors
  • WireGuard-encrypted network traffic
  • Regular third-party penetration testing

Microsoft Azure (OpenAI)

  • ISO 27001, SOC 1, SOC 2 certified
  • AI processing deployed in Canada East region

Authentication and Access Control

Section titled “Authentication and Access Control”

Bizby supports multiple authentication methods to meet the needs of individual users and enterprise organizations:

  • Email/Password: Firebase Authentication with built-in protection against credential stuffing and brute-force attacks
  • Google OAuth: One-click sign-in with Google accounts
  • Magic Links: Passwordless email-based sign-in
  • Enterprise SSO: SAML 2.0 and OpenID Connect, tested with Microsoft Entra ID (Azure AD), Okta, and Google Workspace. Includes domain verification, SSO enforcement, just-in-time user provisioning, and MFA delegated to the identity provider.
  • Two-step verification: Any account can add an authenticator app, so signing in also asks for a six-digit code. Enterprise owners can require it for guests. See Two-Step Verification.

Board-level permissions: Owner, Editor, Commenter, and Viewer roles enforced by Firebase Security Rules at the database level. The enterprise owner controls external access: guests and share links can each be turned off for the whole organization, and guests can be required to use two-step verification.

Enterprise sub-team scoping: Content is scoped to sub-teams within an enterprise, ensuring members only see boards belonging to their team.

Encryption

Section titled “Encryption”
  • Data at rest: AES-256 encryption across all storage providers (Google Cloud, Firebase Storage)
  • Data in transit: TLS 1.2+ for all connections, including WebSocket (WSS) for real-time collaboration
  • AI communication: TLS 1.2+ to Azure OpenAI, no data retained by the provider

Canadian Data Residency

Section titled “Canadian Data Residency”

All boards and user data are stored in Canada by default:

  • Database (Firestore): Montreal, Canada (northamerica-northeast1)
  • Board snapshots (Firebase Storage): Montreal, Canada (northamerica-northeast1), source of truth
  • Backend functions (Cloud Functions): Montreal, Canada (northamerica-northeast1)
  • AI processing: Azure OpenAI, Canada East, proxied via Google Cloud Run in Montreal. No data retained.
  • Real-time collaboration (default): Cloudflare Workers with Eastern North America placement preference. Board content in transit is encrypted. All persisted data lands in Firebase Storage Montreal.
  • Real-time collaboration (Canada path): Enterprise customers can enable strict Canadian data residency, routing all WebSocket traffic through Fly.io in Toronto (yyz) with persistence to Firebase Storage Montreal.

Global services (no board content): Stripe (US, payment processing only), SendGrid (US, transactional email only), Firebase Auth (global, identity broker only, enterprise SSO delegates credentials to customer IdP).

AI Data Processing

Section titled “AI Data Processing”

Bizby’s AI features, including summarization, translation, tone adjustment, poll creation, affinity mapping, and word cloud, are powered by Azure OpenAI deployed in Canada East:

  • No US-based AI processing: All AI requests are routed through Google Cloud Run in Montreal to Azure OpenAI in Canada East. Board content never crosses the Canadian border for AI processing.
  • No data retention by the AI provider: Azure OpenAI does not store or use your prompts or completions to train models.
  • Opt-in only: No board content is sent to the AI provider unless a user explicitly triggers an AI feature.
  • Encrypted in transit: All communication between Bizby and Azure OpenAI is encrypted via TLS.
  • Usage controls: AI usage is tracked and limited per subscription tier.

Audit Logging

Section titled “Audit Logging”

Enterprise accounts include an immutable audit trail covering:

  • Authentication events (login success, SSO login blocked, seat limit blocked)
  • Board operations (create, update, delete, share)
  • Member management (invite, remove, role change)
  • SSO configuration changes
  • Sub-team operations
  • Billing and settings changes

Audit logs are filterable by category and exportable as CSV.

PIPEDA Compliance

Section titled “PIPEDA Compliance”

Bizby is designed to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 Fair Information Principles:

  • Accountability: A designated privacy officer (privacy@bizby.ca) oversees compliance.
  • Consent: Meaningful consent is obtained at signup. AI features require explicit user action. Analytics cookies require opt-in via cookie banner.
  • Limiting Collection: We collect only the personal information necessary for identified purposes.
  • Canadian Data Residency: Board content and user data at rest are stored in Montreal. AI processing occurs in Canada East. Enterprise customers can pin real-time collaboration to Toronto.
  • Safeguards: AES-256 encryption at rest, TLS in transit, Firebase Security Rules, WAF and DDoS protection, SSO with MFA delegation, and authenticator-app two-step verification.
  • Breach Notification: We maintain an incident response plan in compliance with PIPEDA’s mandatory breach reporting requirements.
  • Individual Access: Users can request access to, correction of, or deletion of their personal information within 30 days.

For full details, see our Privacy Policy.

Availability and Backup

Section titled “Availability and Backup”
  • Uptime SLA: 99.5%
  • Board backup: Every 5 minutes to Firebase Storage (Montreal)
  • Board persistence: Every edit persisted within 5 seconds to edge storage
  • Recovery Point Objective: Less than 5 minutes
  • Recovery Time Objective: 4 hours
  • Monitoring: External uptime monitoring, with uptime history and incident history published at status.bizby.ca

Documents Available on Request

Section titled “Documents Available on Request”
  • Information Security Policy
  • Access Control Policy
  • Backup and Disaster Recovery Policy
  • Incident Response Plan
  • Data Classification Policy
  • Vendor Security Questionnaire

For security inquiries, contact privacy@bizby.ca.