Our approach to security
Security is foundational to how we build and operate bizzform's services. We design our systems to keep customer data confidential, intact, and available, and we are continuously improving our security posture as our customer base grows.
This page describes the technical and organisational measures bizzform LLC has in place today. It is updated as our practices evolve. For security inquiries or to report a vulnerability, see Section 12.
1. Hosting and infrastructure
The bizzform.com marketing website runs on managed hosting operated by Webtuga in Portugal (EU). Q70 instances that bizzform hosts on behalf of customers run on virtual private servers operated by IONOS SE in Germany (EU). Customers who deploy on their own infrastructure host the software in environments they choose and control.
Q70 customer installs are single-tenant by default: each bizzform customer who deploys Q70 receives their own database, file storage, and application instance.
2. Network security
- HTTPS only. All traffic to bizzform.com and to bizzform-hosted instances is served over HTTPS using TLS 1.2 or higher. Certificates are issued via Let's Encrypt and auto-renewed.
- Strict transport security (HSTS). Browsers are instructed to use HTTPS exclusively.
- Firewall. Servers run a host-based firewall restricting inbound connections to required ports.
- SSH access. Administrative SSH access is restricted to key-based authentication; password-based SSH is disabled.
- No public database endpoints. Databases are bound to localhost on each Q70 instance.
3. Authentication and access control
- Password hashing. All user passwords are hashed using bcrypt with a per-user salt.
- Two-factor authentication (2FA). Q70 supports TOTP-based 2FA via standard authenticator apps. Backup recovery codes are hashed at rest.
- Role-based access control. Roles (admin, project manager, translator, vendor, customer contact) with scoped permissions.
- Customer-controlled access. Workspace administrators control user invitations, role assignments, and deactivation.
- Brute-force protection. Login attempts are rate-limited.
- Session management. Sessions are bound to the issuing browser, expire after inactivity, and can be revoked.
4. Application security
- Secure software development. Q70 is developed against version-controlled source code with peer review. Every release is recorded in a semantically versioned changelog.
- Dependency management. Third-party libraries are tracked in lockfiles and reviewed periodically.
- Input validation and CSRF protection. All state-changing API endpoints require authentication and CSRF tokens.
- Output escaping. User-supplied content is escaped before rendering to prevent XSS attacks.
- Locked-content integrity. Customer-locked content in translation projects is protected against modification by lower-privileged users.
5. Customer data and processing
- Customer ownership. Customers retain ownership of all content uploaded to or generated within the Services. bizzform processes customer data only on the customer's instructions.
- Data export. Customers can export work product (XLIFF, TMX, JSON, ZIP) at any time without contacting us.
- Data deletion. Customers can delete projects, files, translation memories, and termbases from their workspace. Following termination, customer data is retained for 30 days to allow export, then deleted (subject to backup retention).
- Customer-configured AI providers. Source content is sent to AI/MT providers only when a workspace administrator has explicitly enabled a provider and provided its API key. See our Sub-processors page.
6. Backups and disaster recovery
- Automated nightly backups. Each bizzform-hosted production database is backed up nightly. Backups are integrity-checked at creation.
- Retention. Daily backups retained for 7 days; weekly backups for 4 weeks.
- Restore testing. Backup integrity is verified at creation time. Periodic restore drills before significant releases.
- File backups. Customer files uploaded to bizzform-hosted workspaces are stored on the same server as the database and included in the backup schedule.
- Self-hosted customers are responsible for configuring their own backup schedule. Q70 provides documented export and import tooling to support this.
7. Audit logging
- Task-level audit log. Q70 records workflow events (task creation, automation runs, AI calls, status changes) in an audit log accessible to workspace administrators.
- System-level logs. Web server, application, and security-relevant events are written to system logs and retained for at least 30 days.
- Tamper resistance. Application audit-log entries reference an immutable created-at timestamp.
8. Patch and vulnerability management
- Operating-system patches. bizzform-hosted servers run Ubuntu LTS with security updates applied on a regular cadence.
- Third-party libraries. Backend (Python) and frontend (JavaScript) dependencies are reviewed periodically. Critical-severity advisories are prioritised for immediate remediation.
- PHP version. bizzform.com runs on a supported PHP major version (currently PHP 8.4).
9. Personnel and operational security
- Least privilege. Production access is limited to personnel whose role requires it.
- Administrative MFA. Administrative access to hosting provider control panels and to the bizzform code repository requires multi-factor authentication.
- Source-code repository. Source code is hosted in a private repository with branch protection and access logs.
- Secret management. Production credentials are stored in server environment files outside the source repository. Credentials are rotated when personnel changes occur.
- Confidentiality. Personnel and contractors with access to customer data are bound by confidentiality obligations.
10. Company-formation security
- KYC documents. Identification documents submitted for company-formation engagements are handled securely and shared only with the specific partners required to complete the filing.
- Encryption in transit. Document submission uses HTTPS-only endpoints.
- Retention. Formation records are retained as required by US and applicable foreign law (typically minimum 7 years for tax and corporate records).
11. Incident response and breach notification
- Detection. We monitor application logs and server health on an ongoing basis for bizzform-hosted instances.
- Containment. If a security incident is detected, we will take immediate steps to contain it, preserve evidence, and restore secure operation.
- Notification. If a confirmed personal-data breach within bizzform's responsibility affects customers' personal data, we will notify affected customers without undue delay and, where required, within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33 and applicable US state laws.
- Post-incident review. After containment, we conduct a root-cause analysis and update controls to prevent recurrence.
12. Reporting a security issue (responsible disclosure)
We appreciate reports from independent security researchers. If you believe you have found a vulnerability:
- Email security@bizzform.com with a detailed description of the issue, including steps to reproduce.
- Please give us a reasonable time to investigate and remediate before public disclosure (we suggest 90 days).
- Do not attempt to access, modify, or destroy data that does not belong to you. Do not conduct disruptive testing.
- We do not currently operate a paid bug-bounty programme, but we are happy to acknowledge researchers in a public credits list (with your permission) once an issue is resolved.
13. Compliance posture
bizzform is a Delaware-registered limited liability company. Our processing of personal data is governed by:
- the EU General Data Protection Regulation (GDPR) and UK GDPR, where applicable;
- the California Consumer Privacy Act (CCPA/CPRA) and other US state privacy laws;
- US anti-money-laundering and beneficial-owner reporting requirements (relevant to company-formation services);
- contractual obligations under each customer's Data Processing Agreement.
We do not currently hold SOC 2, ISO 27001, or HIPAA certifications. Customers requiring formal third-party attestation should contact us; we are happy to share evidence of the controls described on this page and to participate in customer-led security assessments.
14. Contact
Security: security@bizzform.com
Privacy: privacy@bizzform.com
General: hello@bizzform.com
bizzform LLC
254 Chapman Rd, Ste 208 #17308
Newark, Delaware 19702
United States