Security

How Boundstone is built and what it holds

Written the same way the API answers: what we actually do, and — further down — what we don't have yet. If a control isn't listed here, assume we don't have it and ask.

Credentials

  • There are no passwords.Sign-in is a single-use link that expires in 15 minutes, or Google — so there is no password of yours for us to leak.
  • API keys are stored as SHA-256 hashes.The key itself is shown once, at creation, and never again. We cannot recover it for you, or for anyone claiming to be you.
  • Revocation is immediate and self-serve.From the dashboard. A revoked key fails on its next call.
  • Sessions are HttpOnly, Secure, SameSite cookies.Stored as hashes, expiring after 30 days, and you can sign out every other device from the dashboard.
  • Administrative access is compared in constant time.The check leaks neither length nor position.

Your data

  • We never see a card.Payment details go directly to Stripe's hosted checkout; no card number, expiry or CVC ever reaches our systems.
  • Export is one click.Everything we hold on your account, as JSON. It contains key metadata but never key hashes; we check this.
  • Deletion is one click, immediate and permanent.Cascading every account-scoped table. No soft-delete, no backup copy waiting to be restored.
  • Retention is scheduled, not indefinite.Per-call usage detail compacts into daily aggregates after 90 days, bulk job inputs and results are purged after 30, idempotency keys expire after 24 hours, and used sign-in tokens are swept immediately.
  • The keyless homepage demo stores only a salted hash of the IP.Never the address, never what was typed.
  • We do not sell or share your data or your queries.And we do not build datasets from what you look up.

The service itself

  • Everything runs on Cloudflare's edge network, TLS throughout.Secrets live in the platform's encrypted secret store, never in the repository.
  • The database supports 30-day point-in-time recovery.A restore point is captured before any schema change.
  • Per-key rate limits ship with standard IETF RateLimit headers.So your client can see its own budget.
  • Idempotency keys on every charged endpoint.A retried request can't double-charge you.
  • Outbound webhooks are HMAC-SHA256 signed.So you can verify they came from us. Endpoints are validated against internal addresses when registered, and a delivery that tries to redirect is refused rather than followed.
  • Abuse controls run ahead of the marketing.Disposable-domain screening, per-IP signup limits, input length caps before parsing, checkout-attempt caps, and automatic key revocation on a card-fraud signal.

Knowing when something breaks

  • A probe runs every minute.Against the worker, the database and a DNS dependency; three consecutive failures raise an alert.
  • An independent external monitor watches from outside our infrastructure.Because a health check that lives inside the thing it's checking can't report its own death.
  • Results are public on the status page.Labelled honestly as an internal probe rather than dressed up as multi-region monitoring.

What we don't have yet

Every company's security page lists what it has. Here is what we don't, because you'd otherwise have to ask — and because a company this young claiming otherwise would be the tell:

  • No SOC 2, no ISO 27001.Neither is in progress. We are a very new company and would rather say so than imply a certification we haven't earned.
  • No third-party penetration test.The code has been reviewed and hardened internally, and the money paths carry automated tests, but nobody independent has attacked it yet.
  • No formal DPA yet.Our Terms and Privacy Policy are published in draft and under legal review; a data-processing agreement lands with that review.
  • No bug bounty.There's no budget for one yet — but see below, and we will credit you.
  • No SLA.Our uptime is measured and published; it is a log, not a contractual promise. We won't sell you the promise until we can stand behind it.

Reporting something

If you find a vulnerability, email security@boundstone.io. It reaches a person, not a queue. Please give us a reasonable window to fix it before publishing, and we'll credit you unless you'd rather we didn't. We won't threaten you with lawyers for reporting a bug in good faith.

Last reviewed 2026-07-27. If something here stops being true, this page changes the same day — the same rule the rest of the site runs on.