BOS operates under a three-layer shared responsibility model: the security our own platform implements, the data infrastructure, and the hosting infrastructure. Here's the detail on what each one protects.
Authentication, permissions, per-account isolation, user data, secrets, logic and monitoring. The layer we design and control ourselves.
Encryption at rest, backups and point-in-time recovery (PITR), engine-level Row Level Security. SOC 2 Type 2.
Network, TLS, DDoS/WAF mitigation and platform availability. ISO 27001:2022 and SOC 2 Type II.
Every organization lives fully isolated from the rest. Isolation doesn't rely on code alone: it's enforced at the database level via RLS and a fail-closed account-identification function — when in doubt, it denies access.
Each person sees and does only what applies to them, with redundant validation across four independent layers. Beyond the base role, it also supports individual permissions granted or denied per user.
Access via Microsoft and Google (OAuth). MFA at the identity-provider level; credentials managed by the auth layer, with session-token hashing and rotation.
An in-house agent continuously analyzes activity and alerts on anomalous behavior: mass deletions, privilege escalation, impersonation, access from multiple IPs, bulk edits, and audit-log tampering, among others.
Every write operation (create, edit, delete) is logged with author, date and detail in a queryable audit log.
Especially sensitive billing, finance and accounting data — amounts, margins, compensation — is separated into its own storage with stricter access policies than the rest of the information.
Aurora answers exclusively with information from the account of the user asking, respecting their role and permissions. Isolation is enforced on every query, with automatic checks that prevent cross-organization leakage.
All traffic travels encrypted (HTTPS/TLS). Strict headers: CSP, HSTS with preload, X-Frame-Options DENY (anti-clickjacking), nosniff, Referrer-Policy and Permissions-Policy.
Traffic limiting on sensitive operations to mitigate abuse. Support access via impersonation is controlled and fully audited.
SOC 2 Type 2, audited periodically. GDPR DPA and, for regulated health use cases, the ability to operate under HIPAA via specific configuration and contractual agreement (BAA).
Data access control at the database engine level, row by row.
SSL to the database, with optional network/IP restriction. MFA and SSO for accounts and the organization.
Automatic backups and optional point-in-time recovery (PITR).
Deployment in a defined region (with an EU option), as part of compliance under the shared responsibility model.
Automatic SSL certificates, HTTP-to-HTTPS redirection and support for TLS 1.2 and 1.3.
Automatic DDoS mitigation and firewall on every deployment, with optional WAF rules, IP blocking and additional traffic limiting.
ISO 27001:2022 and SOC 2 Type II attestation. GDPR compliance and DPA support available.
We'll share the full technical documentation and answer your security questionnaire.
BOS is a product of Synova Digital Solutions SRL (CUIT 30-71890877-5), Av. Scalabrini Ortiz 1135, Ciudad Autónoma de Buenos Aires, Argentina. For security or privacy inquiries: desarrollo@synova.la.