Security & privacy
Protecting your organisation and the people who answer
Security and privacy in bebonium aren't settings — they're how the product is built. Here's what that means in practice.
Security & privacy
Sign-in and sessions
- Two-step sign-in: your password, then a 6-digit code sent to your email — or your Google or Microsoft account
- Passwords are stored as Argon2id hashes, never in plain text
- Repeated failures lock the account, and every sign-in step is rate-limited
- Sessions use short-lived access tokens and refresh cookies that rotate on every use; a replayed cookie ends the whole session
- Google and Microsoft sign-in use OpenID Connect with PKCE, ask only for your name and verified email address, and a session started that way ends after 24 hours
- Deactivating a teammate signs them out everywhere, immediately
Your data stays yours
- Every organisation's data is isolated: each query is scoped to your organisation, taken from your session — never from the address
- Our own console never shows your people records or responses, with two narrow exceptions: our email log lists who each email went to, masked for everyone on our team except bebonium's owner, and only that owner can download a data export of your organisation — every download appears in your activity log
- Our team signs in to that console with an authenticator app — mandatory, with no bypass
- HR system credentials are stored encrypted, and HR sync never brings in salary, bank details or national ID numbers
Respondent privacy
- Confidential surveys hide every group smaller than your minimum group size
- Anonymous surveys never link a response to a person, and store response times to the day
- Survey keys travel after the # and in a request header — never in an address — and our logs redact survey links
- The language someone answers in is never recorded
- Personal details such as names and emails never appear in a page address
Access and accountability
- Page-level roles with separate read and write access
- An activity log of every change, with each person's own activity visible to them
- Support works on your surveys only inside a window you open, for 1, 4, 24 or 72 hours — and every action is logged
- Your company domain is offered only to someone who has proved they own an address on it — typing an address never reveals which organisations use bebonium
Hardened by default
- Rate limits on every endpoint
- Uploaded images are checked by their content, not their name; SVG files are refused
- No third-party trackers or cookies on this website; bebonium counts page visits itself, without cookies and without storing IP addresses
What we don't claim
We don't display certification badges we don't hold. If your organisation needs a security questionnaire answered or has questions about where data is hosted, talk to us and we'll give you straight answers.
Report a security issue
Found something that doesn't look right? Email us and we'll respond promptly.
Find out what your people really think
Start free, or talk to us about rolling bebonium out across your organisation.