Your clients’ data, your invoicing and your payroll are protected in three layers, and each one has a clear owner (a shared responsibility model): our own platform, the data infrastructure and the hosting infrastructure. Here’s exactly what each one protects.
LAYER 01
Our platform
Responsible: BOS
Authentication, permissions, per-account isolation, user data, secrets, logic and monitoring. The layer we design and control ourselves.
LAYER 02
Data infrastructure
Responsible: Supabase
Encryption at rest, backups and point-in-time recovery (PITR), engine-level Row Level Security. SOC 2 Type 2.
LAYER 03
Hosting infrastructure
Responsible: Vercel
Network, TLS, DDoS/WAF mitigation and platform availability. ISO 27001:2022 and SOC 2 Type II.
The ISO 27001 and SOC 2 certifications belong to our infrastructure providers (Vercel and Supabase); they are not a certification of BOS as a product.
01 · Our platform
The layer protecting you every single day.
Nobody from another company can see your data
Every organization lives fully isolated from the rest (multi-tenant architecture). Isolation doesn’t rely on code alone: it’s enforced in the database itself via RLS and an account-identification function designed so that, if something fails, access closes — when in doubt, it denies.
Role-based permissions, checked in 4 layers
Each person sees and does only what applies to them. Role-based access control with redundant validation across four independent layers. Beyond the base role, it also supports individual permissions granted or denied per user.
Sign in with your Microsoft or Google account
Access with the account your team already uses, via Microsoft and Google (OAuth), with your identity provider’s two-step verification (MFA). Credentials managed by the authentication layer, with session-token hashing and rotation.
Alerts on suspicious activity, 24/7
An in-house security agent continuously analyzes activity and alerts on anomalous behavior: mass deletions, privilege escalation, impersonation, access from multiple IPs, bulk edits, and audit-log tampering, among others.
Who changed what, and when
Every write operation (create, edit, delete) is logged with author, date and detail in a queryable audit log.
Amounts, margins and payroll, better protected
Especially sensitive billing, finance and accounting data — amounts, margins, compensation — is separated into its own storage with stricter access policies than the rest of the information.
Aurora only sees what you can see
Aurora answers exclusively with information from the account of the user asking, respecting their role and permissions. Isolation is enforced on every query, with automatic checks that prevent cross-organization leakage.
Everything travels encrypted
All traffic travels encrypted (HTTPS/TLS). Plus strict headers that protect the browser: CSP, HSTS with preload, X-Frame-Options DENY (anti-clickjacking), nosniff, Referrer-Policy and Permissions-Policy.
Abuse limits and audited support
Traffic limiting (rate limiting) on sensitive operations to mitigate abuse. When support signs in as a user to help them (impersonation), access is controlled and fully audited.
The 4 layers that check every permission
01
Middleware
Blocks entire routes based on role, before the request reaches the application.
02
API
Every endpoint validates role and permissions on every request.
03
Database · RLS
PostgreSQL-level policies: the database only returns the rows that apply.
04
Interface
The UI is built from effective permissions. What doesn't apply simply doesn't exist on screen.
02 · Data infrastructure — Supabase
Enterprise-grade controls.
Compliance
SOC 2 Type 2, audited periodically. GDPR DPA and, for regulated health use cases, the ability to operate under HIPAA via specific configuration and contractual agreement (BAA).
Row Level Security
Data access control at the database engine level, row by row.
Encrypted connections
SSL to the database, with optional network/IP restriction. MFA and SSO for accounts and the organization.
Continuity
Automatic backups and optional point-in-time recovery (PITR).
Data residency
Your data is stored in a defined region (with an EU option), as part of compliance under the shared responsibility model.
03 · Hosting infrastructure — Vercel
Managed infrastructure security.
Mandatory HTTPS
Automatic SSL certificates, HTTP-to-HTTPS redirection and support for TLS 1.2 and 1.3.
DDoS and firewall
Automatic DDoS mitigation and firewall on every deployment, with optional WAF rules, IP blocking and additional traffic limiting.
Provider compliance
ISO 27001:2022 and SOC 2 Type II attestation. GDPR compliance and DPA support available.
04 · Privacy and personal data protection
Your data, handled by law.
Topic
How we handle it
Legal framework
Argentina's Law 25.326 on Personal Data Protection and, when applicable by user location, GDPR principles.
Principles
Data minimization, access control and role-based segmentation.
Policies
Our own Privacy Policy, cookie-consent management, and a process for handling data-subject rights (access, rectification and deletion).
Subprocessors
Public registry of providers involved in processing: Vercel (hosting), Supabase (database and auth), Microsoft and Google (identity/OAuth), Resend (email) and Anthropic (AI assistant).
BOS is a product of Synova Digital Solutions SRL (CUIT 30-71890877-5), Av. Scalabrini Ortiz 1135, Ciudad Autónoma de Buenos Aires, Argentina. For security or privacy inquiries: desarrollo@synova.la.
