Security
Your data is our responsibility.
Encryption, access control, Singapore data, and a way to tell us if you find a hole. The details are below.
What we actually do
The controls.
Encryption
AES-256 at rest, TLS 1.3 in transit. That is the floor, not a badge.
Infrastructure
The app runs on Cloudflare Workers, a global edge network with DDoS protection built in.
Access
Least privilege by default. Actions are logged. You can pull an audit trail.
Data Residency
Postgres in Singapore. It does not get copied to another region unless you ask.
Compliance
Aligned with PDPA. We review the controls and change them when they are wrong.
Incident Response
Written steps, who to wake, and you hear it from us first if something breaks.
Security Practices
How we operate.
All production access requires multi-factor authentication
Secrets live in Cloudflare Secrets Store, not in the repo or a stray env file
Infrastructure changes are reviewed before they go out
Database queries use parameterised statements. No string-built SQL
Automated dependency scanning for known vulnerabilities
Regular backups with tested restoration procedures
API endpoints are authenticated and rate-limited
Client data is logically isolated per tenant
If you find a hole
Email security@bistank.com. We will reply. Give us time to fix it before you publish.
security@bistank.comQuestions about security?
Email hello@bistank.com, or security@bistank.com if it is a hole.