Beezifi Inc. takes security seriously. This Security Policy describes the technical and organizational safeguards implemented in the Beezifi Security gateway platform (the "Service") to protect tenant accounts, API keys, request data, and platform infrastructure. Because Beezifi Security is itself a security product, the platform is built and operated with an adversarial mindset — the assumption that the gateway is a high-value target for attacks directed at tenants and Beezifi alike.
This policy is incorporated by reference into our Terms of Service and Privacy Policy.
Dashboard passwords are stored using bcrypt with work factor 12. Plaintext passwords are never written to storage or logs.
API keys are stored exclusively as SHA-256 hashes. The full plaintext key is shown only once at issuance and cannot be recovered from the Service.
Dashboard sessions use signed JSON Web Tokens (HS256) that expire after 24 hours (operator sessions: 8 hours). When two-factor authentication is on, a separate 5-minute token covers the second step. Tokens are stored in localStorage and cleared on sign-out.
Dashboard and login APIs are rate-limited per client IP, with a stricter limit on operator login. The decision endpoint is limited per API key (200 decisions per second by default) plus a per-IP flood guard. Limits are shared across all platform instances.
API keys use the prefix bzf_ followed by 48 cryptographically random hexadecimal
characters (192 bits of entropy). Keys are generated using Node.js's
crypto.randomBytes() and are immediately hashed with SHA-256 before storage.
Key rotation is available at any time from the dashboard; rotation immediately invalidates the
prior key. Tenants can revoke any key individually; each account may hold up to 10 active keys.
Beezifi has no ability to recover or expose a plaintext API key after issuance. If a key is lost, it must be rotated. You are solely responsible for the secure storage and authorized use of your API keys.
All communication between clients and the Service is encrypted using TLS 1.2 or higher. Unencrypted HTTP connections should be blocked at your infrastructure level. HTTP Strict Transport Security (HSTS) headers are enforced on the dashboard to prevent downgrade attacks.
The Service dashboard is hardened with the following HTTP security headers via Helmet.js:
script-src-attr 'none'); plugins
are blocked; only the Service may frame its pages (frame-ancestors 'self')Inline styles are still permitted by the policy. Untrusted values shown in the dashboard (such as log fields and names) are HTML-escaped before rendering, in addition to the CSP.
All tenants share one database. Every record — rules, API keys, request logs, firewall targets and
balances — carries a tenant_id, and every query is filtered by the tenant ID taken from
the signed session, never from client input. Individual objects are looked up by both their own ID
and the tenant ID. In-memory and Redis caches are keyed by API key or tenant. Even if an authenticated
dashboard session were compromised, it would have access only to the corresponding tenant's data.
The decision endpoint (POST /api/v1/check) is designed as the critical path and
is hardened accordingly:
The security rule engine evaluates rules in strict priority order (lowest priority number first) and short-circuits on first match. Rule types supported include: IP blocklists and allowlists (with CIDR notation), geographic block and allow rules, geofence rules (Haversine great-circle distance), rate limiting (fixed window, tracked per rule per IP or API key), user-agent pattern matching, and path prefix/exact/regex matching. Rule type and action are validated on write; malformed patterns are skipped safely at evaluation. IPv4 and IPv6 addresses and ranges are supported. BLOCK and REDIRECT decisions are accompanied by configurable ghost responses to limit information leakage.
Request logs are scoped strictly to the originating tenant and contain the evaluation inputs you submitted and the decision output. Tenants can purge their own logs. Log data is not shared with other tenants or used by Beezifi for purposes beyond operating the Service and security investigations. Logs are deleted automatically after 90 days; daily aggregate counts without IPs, paths or user agents are kept for long-range analytics.
The optional UFW agent runs on your servers. Each server has its own random agent secret, shown once
and stored by Beezifi only encrypted (AES-256-GCM); it is independent of your API keys. By default the
agent is deny-only: it can add deny/reject rules and delete only rules it created, so it
cannot open ports or remove your own rules. It runs ufw without a shell and validates every
field, and it refuses to listen beyond loopback without TLS. Beezifi never pushes blocks for private,
loopback or link-local addresses.
All payment processing is delegated to Stripe, Inc. Beezifi never receives, processes, or stores raw payment card data. Card details are entered into Stripe-hosted payment fields (Stripe Payment Element) on Stripe's PCI-DSS-compliant infrastructure. Beezifi stores only the Stripe customer ID and payment intent ID for reconciliation. Stripe webhooks are verified using HMAC-SHA256 signature validation before any balance credit is applied, and fulfilment is idempotent. Crypto payments are processed through MooChedda; Beezifi records the invoice and transaction hash.
Security is a shared responsibility. To protect your tenant account and API keys, you must:
In the event of a confirmed security incident affecting tenant data, Beezifi Inc. will:
If you believe you have discovered a security vulnerability in the Service, please report it responsibly before public disclosure:
This Security Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of the State of Washington, United States, without regard to its conflict-of-law provisions. By using the Service, you consent to the exclusive jurisdiction of the courts located in Washington State, as described in our Terms of Service.
For security questions, incident reports, or vulnerability disclosures:
Email: security@beezifi.com
Response target: 2 business days for security reports