Security architecture overview
BitGuardIT is a multi-tenant cybersecurity SaaS platform with separate client, staff, and administrator portals, a centralized identity and platform API layer, and integrated scanning, monitoring, reporting, and notification services. Security controls are applied at the network edge, application layer, and data layer.
Defense-in-depth approach
- Host-based and subdomain routing restrictions for production portals.
- Authenticated API access for all business operations.
- Organization-scoped data access in application services.
- Encryption in transit for client and API communication.
- Role-based authorization for sensitive administrative functions.
Identity security
User identity is managed through the BitGuardIT identity service with account types for clients, staff, and platform administrators. Email verification, password reset flows, and invitation-based onboarding are supported.
Authentication controls
- Password-based authentication with secure storage of credentials.
- Bearer access tokens for API and portal session continuity.
- Separate authentication entry points for client and administrator password reset where configured.
Role-based access control
- Account type enforcement (CLIENT, STAFF, ADMIN) on portal routes and API dependencies.
- Organization-scoped queries for client data.
- Staff access limited to assigned clients, cases, and operational scopes.
- Platform-owner-only capabilities for sensitive administrative functions such as demo subscription management.
Client, staff, and admin separation
Production deployments use dedicated hostnames for client, staff, and admin portals with middleware path restrictions to reduce cross-portal exposure. Users are redirected to the appropriate home portal for their account type.
Session management
- Session tokens stored using browser local storage mechanisms with portal idle timeout handling.
- Sign-out invalidates client-side session context; users must re-authenticate.
- Idle session warnings and automatic logout configurable in the portal.
Encryption practices
TLS is used for data in transit between browsers, APIs, and integrated services. Sensitive credentials such as integration API keys are stored on servers with access restricted to operational systems. Customers should use TLS-protected targets where applicable for scanning accuracy.
API security
- Authenticated endpoints require valid access tokens.
- Gateway proxy routing to internal identity and platform services.
- Account-type and feature entitlement checks on sensitive operations.
- Organization isolation in service layer queries.
Secure development practices
BitGuardIT follows internal development standards including code review, dependency management, and separation of production secrets from source repositories. Security-sensitive changes undergo additional scrutiny.
Logging and audit trails
- Administrative action audit logs for platform operations.
- Authentication and authorization events for security monitoring.
- Case assignment and workflow history for human-assisted services.
Monitoring and alerting
Platform health and API availability are monitored operationally. Customer-facing monitoring and alerting features provide visibility into asset status, certificate issues, and scan-derived findings according to subscription entitlements.
Vulnerability management
BitGuardIT maintains internal processes to assess and remediate vulnerabilities in platform components. Third-party reports submitted to security@bitguardit.com are reviewed and prioritized based on severity and exploitability.
Backup and recovery
Production data stores are backed up according to internal operational schedules. Recovery procedures are tested periodically to support business continuity objectives.
Infrastructure security
Platform infrastructure is hosted with cloud providers using network segmentation, access controls, and hardened configurations appropriate to the service tier. Direct infrastructure access is limited to authorized personnel.
Access control reviews
Administrative and staff access is granted on a least-privilege basis and reviewed periodically. Access is revoked promptly when roles change or employment ends.
Incident response process
Suspected security incidents affecting the platform are triaged by the BitGuardIT security team, contained, investigated, and remediated following internal runbooks. Affected customers will be notified when their data is materially impacted, consistent with applicable law and contractual obligations.
Data protection practices
- Logical separation of customer organization data in application queries.
- Minimal staff access to client content on a need-to-know basis.
- Secure handling of payment references through certified payment processors.
Ownership verification before scanning
Customers must complete ownership verification before scans run against registered assets. Production environments may require DNS TXT validation; unauthorized targets are rejected at submission.
AI-assisted security analysis safeguards
- AI features are gated by subscription entitlements where applicable.
- Server-side enforcement on chat and recommendation endpoints for client accounts.
- Advisory output labeled as guidance, not authoritative compliance determination.
- Human escalation available through tickets and professional services.
Human escalation process
Customers may escalate complex findings, incidents, and service needs through tickets, cases, and catalog services. Staff workflows support assignment, internal notes, and customer-visible updates.
Responsible disclosure process
Report platform vulnerabilities to security@bitguardit.com. We request coordinated disclosure and will acknowledge receipt and work toward remediation for validated issues. We do not operate a public bug bounty program unless separately announced.