Beezifi Inc. takes security seriously. This Security Policy describes the technical and organizational safeguards implemented in the Beezifi Security gateway platform (the "Service") to protect tenant accounts, API keys, request data, and platform infrastructure. Because Beezifi Security is itself a security product, the platform is built and operated with an adversarial mindset — the assumption that the gateway is a high-value target for attacks directed at tenants and Beezifi alike.
This policy is incorporated by reference into our Terms of Service and Privacy Policy.
Dashboard passwords are stored using bcrypt with work factor 12. Plaintext passwords are never written to storage or logs.
API keys are stored exclusively as SHA-256 hashes. The full plaintext key is shown only once at issuance and cannot be recovered from the Service.
Dashboard sessions use short-lived JSON Web Tokens (HS256) with issuer validation. Tokens are stored in localStorage and cleared on sign-out.
Authentication and API endpoints are individually rate-limited. The decision endpoint is limited to 50 calls per second per IP to prevent brute-force key enumeration.
API keys use the prefix bzf_ followed by 48 cryptographically random hexadecimal
characters (192 bits of entropy). Keys are generated using Node.js's
crypto.randomBytes() and are immediately hashed with SHA-256 before storage.
Key rotation is available at any time from the dashboard; rotation immediately invalidates the
prior key. Tenants can revoke individual keys or all keys simultaneously.
Beezifi has no ability to recover or expose a plaintext API key after issuance. If a key is lost, it must be rotated. You are solely responsible for the secure storage and authorized use of your API keys.
All communication between clients and the Service is encrypted using TLS 1.2 or higher. Unencrypted HTTP connections should be blocked at your infrastructure level. HTTP Strict Transport Security (HSTS) headers are enforced on the dashboard to prevent downgrade attacks.
The Service dashboard is hardened with the following HTTP security headers via Helmet.js:
Note: Content-Security-Policy (CSP) is currently relaxed to permit the dashboard's
inline scripts and CDN-hosted chart libraries. Tighter CSP constraints are on the security
roadmap.
All tenant data — rules, API keys, request logs, and bandwidth balances — is scoped by
a tenant_id enforced at every database query layer. Foreign key constraints and
application-layer validation prevent cross-tenant data access. No shared caches or data
structures are used across tenant boundaries. Even if an authenticated dashboard session were
compromised, it would have access only to the corresponding tenant's data.
The decision endpoint (POST /api/v1/check) is designed as the critical path and
is hardened accordingly:
The security rule engine evaluates rules in strict priority order (lowest priority number first) and short-circuits on first match. Rule types supported include: IP blocklists and allowlists (with CIDR notation), geographic block and allow rules, geofence rules (Haversine great-circle distance), rate limiting (sliding window, tracked per-rule per identifier), user-agent pattern matching, and path prefix/suffix/exact matching. Rule configurations are validated on write and rejected if malformed. BLOCK and REDIRECT decisions are accompanied by configurable ghost responses to prevent information leakage.
Request logs are stored in append-only database records and are scoped strictly to the originating tenant. Logs contain the evaluation inputs you submitted and the decision output. Log data is not shared with other tenants or used by Beezifi for purposes beyond operating the Service and security investigations. Logs are retained for 90 days by default.
All payment processing is delegated to Stripe, Inc. Beezifi never receives, processes, or stores raw payment card data. The checkout flow is handled entirely on Stripe's PCI-DSS-compliant infrastructure via Stripe Checkout. Beezifi stores only the Stripe customer ID, session ID, and payment intent ID for reconciliation purposes. Stripe webhooks are verified using HMAC-SHA256 signature validation before any balance credit is applied.
Security is a shared responsibility. To protect your tenant account and API keys, you must:
In the event of a confirmed security incident affecting tenant data, Beezifi Inc. will:
If you believe you have discovered a security vulnerability in the Service, please report it responsibly before public disclosure:
This Security Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of the State of Washington, United States, without regard to its conflict-of-law provisions. By using the Service, you consent to the exclusive jurisdiction of the courts located in Washington State for any matters not subject to arbitration under our Terms of Service.
For security questions, incident reports, or vulnerability disclosures:
Email: security@beezifi.com
Response target: 2 business days for security reports