Security

How we protect your data

• HTTPS everywhere. Traffic between your browser and Benchley is encrypted in transit.
• Passwords are hashed. They are stored only as salted scrypt hashes, never in a form we can read.
• Two-factor sign-in. Anyone can turn it on for their account. The two-factor secret is stored encrypted.
• Encrypted secrets. Secrets we need to read back are stored encrypted. Secrets we only need to check, such as API tokens and invite and calendar links, are stored only as hashes.
• Rate limits. Sign-in and sign-up attempts are rate limited to slow down guessing and abuse.
• Role-based permissions. What each person can see and change depends on their role in the workspace. Rates and costs are visible only to people who are permitted to see money.
• Audit log. Changes in a workspace are recorded, so you can see what changed.
• Signed webhooks. Webhooks we send are signed, so your receiver can check they came from Benchley.
• Sessions that expire. A sign-in session ends after 30 days.
• Backups. Our database host, Neon, makes database backups.

The companies that host Benchley are listed on the subprocessors page. What we collect and how long we keep it is in the Privacy Policy.

What this page is

This page describes the measures we have in place today. No system is perfectly secure, and this is a description, not a guarantee.

Report a vulnerability

If you think you have found a security problem in Benchley, email our contact address (coming soon). Tell us what you found, where, and the steps to reproduce it. We will look at every report.

While you investigate, please:

• do not access, change or delete data that is not yours;
• do not disrupt the service for other people;
• give us reasonable time to fix the problem before you share it publicly.

If you are a customer and think your account or workspace has been accessed without your permission, email the same address straight away.