Security

Bureauify is built on AWS with security at every layer. Your data is encrypted, isolated, and processed on infrastructure that meets federal compliance standards.

Infrastructure

✓Hosted entirely on AWS (us-east-1) with SOC 2 / FedRAMP-certified infrastructure
✓All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
✓Compute runs on AWS Lambda with ephemeral execution — no persistent servers to compromise
✓CloudFront CDN with WAF for DDoS protection and bot mitigation
✓DynamoDB and OpenSearch clusters in private VPC subnets

Authentication & Access

✓Amazon Cognito for identity management with JWT-based sessions
✓Passkey / FIDO2 support for phishing-resistant authentication
✓OAuth federation (Google, Microsoft) for enterprise SSO
✓Tier-based rate limiting per IP and per user
✓CORS allowlist restricts API access to authorized origins

Application Security

✓Content Security Policy (CSP) headers on all pages
✓HSTS enforced via CloudFront security policy
✓X-Frame-Options, X-Content-Type-Options headers set
✓Secret scanning in CI — blocks commits containing API keys or tokens
✓Weekly automated vulnerability scanning (Trivy + pip-audit)

Data Handling

✓All government contracting data sourced from public federal APIs (SAM.gov, USAspending, FPDS, Grants.gov)
✓User data scoped by authenticated user ID — no cross-tenant data access
✓Intelligence features powered by self-hosted models — your queries never leave our infrastructure
✓Stripe handles all payment processing — we never store credit card numbers
✓Account deletion available — removes all user data from our systems

Monitoring & Response

✓Structured logging with request tracing across all services
✓Real-time health monitoring with hierarchical service checks
✓CloudWatch alarms for anomaly detection on ETL pipelines and API latency
✓Public status page at status.bureauify.com

Report a Vulnerability

If you discover a security issue, please email security@bureauify.com. We take all reports seriously and will respond within 48 hours.