Security at Bleepy

Our database and uploaded files are hosted by Supabase in London, in the United Kingdom. The Bleepy application is hosted by Vercel. Emails are sent through Microsoft 365. Card payments, where an organisation takes them, are handled by Stripe.

The full list of providers that process personal data for us, and what each one does, is on our sub-processors page.

• Each organisation has its own web address, and people sign in on their own organisation's site.
• An account belongs to one organisation. The same email address used at two organisations is two separate accounts.
• Sign-in sessions belong to the site where you signed in and are not shared with other organisations' sites.
• Every request is checked against the person's membership of that organisation, and every record and uploaded file is stored against its organisation.
• We test this separation automatically before each release.

All connections to Bleepy use HTTPS, and browsers are told to use only secure connections. Our hosting providers encrypt stored data at rest.

• Passwords are stored only as salted one-way hashes (bcrypt). Nobody at Bleepy can read your password.
• Passwords must meet our password policy.
• After 10 failed sign-in attempts, the account is locked for 15 minutes.
• Sessions end after 24 hours, or after 30 days if you choose “Remember me”.

When an organisation charges for an event, payment is taken by Stripe. Card numbers go directly to Stripe. Bleepy never sees or stores them.

Our database provider takes automatic daily backups. Point-in-time recovery is not yet switched on, and we have not yet carried out a full test restore. Both are planned.

Learners can download a copy of their data and delete their account from their privacy settings. Our privacy notice explains what we collect, why, and how long we keep it.

Organisations considering Bleepy can ask for our data processing agreement, data protection impact assessment and answers to a security questionnaire. Use the contact form or email support@bleepy.co.uk.

Bleepy does not currently hold a security certification. We will update this page if that changes.

If you think you have found a security problem, email support@bleepy.co.uk with “Security” in the subject. Please do not include passwords or personal data. We aim to acknowledge reports within 2 working days.