Security policy

Security controls, vulnerability disclosure and operational practices.

Byt-Wyze security controls, disclosure process and operational practices.

Our managed database platform performs automated backups with point-in-time recovery. Hosting is provided on managed, redundant infrastructure. Restoration procedures are exercised as part of platform maintenance.

We do not currently claim any completed third-party penetration test, ISO 27001 certification or SOC 2 attestation. Where and when such work is completed, it will be stated on the Compliance Centre page with its date and scope. We will not imply assurance we do not hold.

• Security Policy
• All traffic to the website, dashboards and APIs is served over HTTPS with TLS.
• Data at rest in our managed database and object storage is encrypted by the platform.
• Credentials are stored as salted hashes; we never store plaintext passwords.
• API keys and service secrets are held server-side in a managed secret store and are never exposed to the browser.
• Account access uses email and password authentication with session tokens issued by our managed auth provider.
• Row-level security is enabled on application tables, so records are readable only by their owner or an authorised administrator.
• Administrative privileges are held in a dedicated roles table and checked server-side; they are never inferred from client-side state.
• Product APIs require a scoped key; keys are rate-limited, quota-enforced and individually revocable.
• Requests forwarded to our compute services are authenticated with a rotating shared secret.