Beezifi Accounting
Sign In

Security Policy

Effective Date: May 1, 2026  ·  Last Updated: May 1, 2026  ·  Beezifi Inc.

Table of Contents

  1. Overview and Commitment
  2. Scope of This Policy
  3. Infrastructure and Data Center Security
  4. Data Encryption
  5. Access Controls and Authentication
  6. Application Security
  7. Tenant Isolation and Multi-Tenancy
  8. Network Security
  9. Vulnerability Management
  10. Incident Response
  11. Business Continuity and Disaster Recovery
  12. Third-Party and Vendor Security
  13. Employee and Contractor Security
  14. Responsible Disclosure
  15. Security Limitations and Disclaimer
  16. Contact

1. Overview and Commitment

Beezifi Inc. ("Beezifi," "we," "us," or "our") takes the security of your data seriously. Beezifi Accounting is a cloud-based accounting platform that processes sensitive financial and business information on behalf of our customers ("you," "Customer," or "User"). We implement technical, administrative, and organizational safeguards to protect that data.

This Security Policy describes the security practices we follow and the controls we have in place for Beezifi Accounting (accessible at accounting.beezifi.com and related subdomains). It is provided for informational purposes and does not constitute a warranty, guarantee, or contractual commitment regarding any specific security outcome.

NO SECURITY SYSTEM IS IMPENETRABLE. DESPITE BEEZIFI'S EFFORTS, NO SECURITY MEASURE CAN PROVIDE ABSOLUTE PROTECTION AGAINST ALL THREATS. BEEZIFI INC. EXPRESSLY DISCLAIMS LIABILITY FOR SECURITY INCIDENTS, DATA BREACHES, OR UNAUTHORIZED ACCESS RESULTING FROM CIRCUMSTANCES OUTSIDE OF BEEZIFI'S REASONABLE CONTROL, INCLUDING BUT NOT LIMITED TO THIRD-PARTY ATTACKS, ZERO-DAY VULNERABILITIES, AND ACTIONS OF CUSTOMERS OR THEIR USERS. PLEASE REVIEW OUR TERMS OF SERVICE FOR THE FULL LIMITATION OF LIABILITY.

2. Scope of This Policy

This policy applies to all systems, services, and infrastructure operated by Beezifi Inc. that support the Beezifi Accounting platform, including:

  • The web application and API servers
  • Production databases storing customer financial and business data
  • Internal tooling and administrative systems with access to production data
  • Third-party services integrated into the platform (see Section 12)

This policy does not apply to third-party websites, applications, or services linked from within the Beezifi Accounting platform, even if such links are displayed within our interface.

Customers are responsible for security within their own accounts, including managing user access, password hygiene, and device security. Beezifi is not liable for security incidents caused by a Customer's own users, credential sharing, account compromise resulting from phishing, or other Customer-side failures.

3. Infrastructure and Data Center Security

Beezifi Accounting is hosted on leading cloud infrastructure providers that maintain industry-recognized security certifications. Our infrastructure benefits from the following physical and environmental controls provided by our hosting partners:

Physical Security

  • 24/7 physical security guards and video surveillance at data center facilities
  • Multi-factor biometric access controls for entry to server rooms
  • Strict visitor access policies with electronic access logs
  • Environmental monitoring for temperature, humidity, and power

Availability and Redundancy

  • Data hosted in multiple availability zones to reduce single-point-of-failure risk
  • Redundant power supplies, network links, and cooling systems at the facility level
  • Automated failover mechanisms for critical system components

Beezifi relies on third-party cloud providers for physical infrastructure security. While we select providers that maintain high security standards, we are not responsible for security failures that occur at the physical infrastructure or data center level beyond our reasonable control.

4. Data Encryption

Encryption in Transit

All data transmitted between your browser (or other client) and Beezifi Accounting servers is protected using Transport Layer Security (TLS 1.2 or higher). We enforce HTTPS for all connections to the platform and reject non-encrypted connections. HTTP Strict Transport Security (HSTS) is enabled to prevent protocol downgrade attacks.

Encryption at Rest

Customer data stored in our production databases is encrypted at rest using industry-standard AES-256 encryption provided by our cloud infrastructure. Database backups are also encrypted using equivalent standards.

Payment Data

Beezifi Accounting does not store raw payment card numbers, CVV codes, or full banking credentials. All payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Beezifi stores only tokenized references (Stripe customer IDs, payment method IDs) that have no value outside of the Stripe system. Please review Stripe's security documentation for information about how they protect payment data.

Encryption Limitations

Encryption protects data from unauthorized access at rest and in transit, but does not protect against threats that operate at the application layer, such as compromised credentials that allow a legitimate-looking authenticated request. Encryption is one control among many and is not a standalone guarantee of data security.

5. Access Controls and Authentication

Customer Authentication

  • All customer accounts are protected by password authentication. Passwords are hashed using a strong one-way hashing algorithm (bcrypt) and are never stored in plaintext.
  • Session tokens are cryptographically random, stored securely, and expire after a period of inactivity.
  • Customers are responsible for maintaining the confidentiality of their login credentials. Beezifi is not liable for unauthorized access resulting from shared, compromised, or weak passwords chosen by the Customer.

Role-Based Access Within Accounts

Beezifi Accounting supports role-based access controls that allow account administrators to assign permissions to users within their workspace. Customers are solely responsible for configuring user roles appropriately and for promptly revoking access for departed employees or unauthorized individuals.

Internal Access Controls

  • Access to production systems and customer data by Beezifi personnel is restricted on a least-privilege basis.
  • Production database access requires multi-factor authentication.
  • All internal access to production data is logged and subject to periodic review.
  • Access rights are reviewed and revoked promptly upon role change or employment termination.

6. Application Security

Secure Development Practices

Beezifi follows a secure software development lifecycle (SSDLC). Security considerations are incorporated at the design, development, and testing phases. Code changes undergo review before deployment to production.

Input Validation and Injection Prevention

We use parameterized queries and prepared statements for all database interactions to prevent SQL injection. User-supplied input is validated and sanitized at the server side. We apply Content Security Policy (CSP) headers and output encoding to mitigate cross-site scripting (XSS) risks.

Authentication and Session Management

Authentication tokens are generated with cryptographically secure random number generators. Session management follows OWASP guidelines. We implement protections against cross-site request forgery (CSRF) for state-changing operations.

Dependencies

We monitor third-party software dependencies for known vulnerabilities and apply security patches in a timely manner. However, zero-day vulnerabilities in dependencies may exist and be exploited before patches are available. Beezifi is not liable for damage caused by undisclosed vulnerabilities in third-party software components.

Disclaimer

BEEZIFI ACCOUNTING IS PROVIDED ON AN "AS-IS" BASIS. DESPITE APPLICATION SECURITY MEASURES, BEEZIFI DOES NOT WARRANT THAT THE SERVICE IS FREE FROM ALL VULNERABILITIES, ERRORS, OR SECURITY FLAWS. NO APPLICATION SECURITY PROGRAM PROVIDES PERFECT PROTECTION. BEEZIFI'S LIABILITY FOR SECURITY INCIDENTS IS LIMITED AS SET FORTH IN OUR TERMS OF SERVICE.

7. Tenant Isolation and Multi-Tenancy

Beezifi Accounting is a multi-tenant platform, meaning multiple customers share the same underlying infrastructure. We implement strict logical data isolation to ensure that each customer's data is accessible only to that customer's authorized users.

Data Isolation Controls

  • Every database record associated with a customer is tagged with a unique tenant identifier.
  • All data queries are scoped by tenant identifier at the application layer; no query is executed without this scope.
  • API endpoints validate that the authenticated user's tenant matches the resource being accessed before returning any data.
  • Cross-tenant data access is not permitted by design and is treated as a critical security violation.

While we implement these controls diligently, multi-tenancy inherently involves shared infrastructure. Beezifi is not liable for theoretical risks that arise from the shared nature of cloud hosting that are beyond our application-layer controls.

8. Network Security

  • Firewalls: Production servers are placed behind network firewalls with restrictive inbound rules. Only necessary ports and protocols are permitted.
  • DDoS Mitigation: We utilize cloud-provider DDoS mitigation services to absorb and filter volumetric attacks. We do not guarantee 100% uptime during a DDoS event.
  • Intrusion Detection: Network and host-level intrusion detection systems monitor for anomalous activity and trigger alerts for investigation.
  • Private Networking: Internal services communicate over private network interfaces and are not exposed to the public internet.
  • VPN: Administrative access to production infrastructure requires VPN connectivity with multi-factor authentication.

Network security controls reduce but cannot eliminate the risk of sophisticated targeted attacks. Beezifi is not liable for service disruptions or data exposure resulting from attacks that exceed the capacity of our mitigation systems.

9. Vulnerability Management

Patching

We apply security patches for operating systems, runtimes, and key dependencies promptly after they become available, prioritizing critical and high-severity vulnerabilities. Patches rated "critical" by vendors are applied on an expedited schedule.

Security Scanning

We perform automated security scanning of our application and dependencies as part of our development and deployment pipelines. Identified vulnerabilities are triaged and remediated according to severity.

Penetration Testing

Beezifi conducts or commissions periodic security assessments and penetration tests to identify weaknesses in our systems. Findings are remediated based on risk priority.

Zero-Day Vulnerabilities

Beezifi is not liable for security incidents caused by zero-day vulnerabilities — that is, vulnerabilities that are unknown to us and to the security community at the time of exploitation. We commit to responding to such vulnerabilities as quickly as reasonably possible once they are disclosed.

10. Incident Response

Beezifi maintains an incident response plan that governs how we detect, contain, investigate, and communicate security incidents.

Detection and Containment

Security events are detected through automated monitoring, alerting systems, and manual review. Upon detecting a potential incident, our security team acts to contain the issue, preserve evidence, and initiate investigation.

Notification

In the event of a confirmed security breach that materially affects Customer data, we will notify affected Customers in accordance with applicable law. Notification will be provided via email to the account's primary contact address. We will include:

  • A description of the nature of the breach to the extent known
  • The categories of data involved
  • Steps we have taken or are taking in response
  • Recommended actions Customers can take to protect themselves

Limitations

Notification timelines depend on the nature and complexity of the incident, regulatory requirements, and any law enforcement instructions that may delay disclosure. Beezifi is not liable for damages arising from delayed notifications where such delays were required by law or reasonable in light of the investigation.

Beezifi is not liable for incidents caused by the Customer's own actions, including compromised credentials, unauthorized sharing of account access, or configuration errors made by the Customer within their workspace.

11. Business Continuity and Disaster Recovery

Backups

Production data is backed up regularly. Backups are encrypted and stored in geographically separated locations to protect against regional failures. Backup integrity is periodically tested.

Recovery Time

We maintain recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical systems. In the event of a disaster, we work to restore service as quickly as reasonably possible. Specific RTO/RPO values are not publicly guaranteed and may vary based on the nature of the incident.

No Guarantee of Uptime

While we strive for high availability, Beezifi does not guarantee uninterrupted access to the Service. We are not liable for losses arising from planned maintenance, unexpected outages, or events outside our reasonable control including natural disasters, cyber attacks, or failures of our third-party infrastructure providers. Please refer to our Terms of Service for the full limitation of liability regarding service availability.

12. Third-Party and Vendor Security

Beezifi integrates with third-party services to provide certain platform functionality. These include but are not limited to:

  • Stripe, Inc. — Payment processing. Stripe is PCI-DSS Level 1 certified. Beezifi does not store raw payment credentials.
  • Cloud infrastructure providers — Hosting, storage, and CDN services. These providers maintain their own security compliance programs (e.g., SOC 2, ISO 27001).
  • Email delivery providers — Transactional email (invoices, notifications, account alerts).

We evaluate third-party vendors for security practices before engagement and require that they maintain appropriate safeguards for any data they access. However, Beezifi is not responsible for the security practices, failures, or data breaches of third-party services. Each third-party provider is independently responsible for their own security posture. Customers should review the privacy and security policies of integrated third-party services directly.

Beezifi is not liable for data breaches, unauthorized access, or service failures that originate with a third-party provider, even where that provider's services are integrated into the Beezifi Accounting platform.

13. Employee and Contractor Security

  • All Beezifi employees and contractors with access to production systems or customer data are subject to background screening as permitted by applicable law.
  • Personnel complete security awareness training upon onboarding and periodically thereafter.
  • All personnel with access to production data are bound by confidentiality agreements.
  • Access rights are granted on a least-privilege basis and are reviewed regularly.
  • Access is revoked promptly upon departure or role change.
  • Personnel are prohibited from accessing Customer data except as necessary to provide the Service, respond to a support request, or investigate a security incident.

Beezifi maintains these personnel controls but is not liable for acts of individual employees or contractors that constitute intentional misconduct, fraud, or criminal activity beyond what would be recoverable under applicable law and our Terms of Service.

14. Responsible Disclosure

Beezifi welcomes reports from the security community about potential vulnerabilities in our systems. If you believe you have discovered a security vulnerability, please report it to us responsibly before disclosing it publicly.

How to Report

Send vulnerability reports to: security@beezifi.com

Please include:

  • A detailed description of the vulnerability
  • Steps to reproduce the issue
  • The potential impact you have identified
  • Any proof-of-concept code or screenshots (if applicable)

Our Commitment

  • We will acknowledge receipt of your report within 5 business days.
  • We will investigate and keep you informed of our findings.
  • We will not take legal action against researchers who follow responsible disclosure practices and do not exceed authorized testing scope.
  • We will work to remediate confirmed vulnerabilities on a risk-based timeline.

Scope

Responsible disclosure applies to security vulnerabilities in Beezifi-controlled systems. Testing that involves accessing, modifying, or exfiltrating another Customer's data; conducting denial-of-service attacks; sending unsolicited bulk communications; or any other activity that harms Beezifi or its customers is not authorized and may result in legal action regardless of intent.

15. Security Limitations and Disclaimer

THE SECURITY MEASURES DESCRIBED IN THIS POLICY REPRESENT BEEZIFI'S CURRENT PRACTICES AND ARE SUBJECT TO CHANGE WITHOUT NOTICE. THIS POLICY IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY AND DOES NOT CREATE ANY WARRANTY, GUARANTEE, REPRESENTATION, OR CONTRACTUAL OBLIGATION ON THE PART OF BEEZIFI INC. REGARDING THE SECURITY OF THE SERVICE OR THE PROTECTION OF CUSTOMER DATA.

BEEZIFI DOES NOT WARRANT THAT THE SERVICE IS FREE FROM ALL SECURITY VULNERABILITIES, THAT UNAUTHORIZED ACCESS WILL NEVER OCCUR, OR THAT DATA BREACHES WILL NEVER HAPPEN. SECURITY IS A SHARED RESPONSIBILITY. CUSTOMERS ARE RESPONSIBLE FOR THEIR OWN ACCOUNT SECURITY, INCLUDING CREDENTIAL MANAGEMENT, USER ACCESS CONFIGURATION, AND DEVICE SECURITY.

IN NO EVENT SHALL BEEZIFI INC., ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AFFILIATES, LICENSORS, OR SERVICE PROVIDERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING FROM OR RELATED TO A SECURITY INCIDENT, DATA BREACH, UNAUTHORIZED ACCESS, DATA LOSS, OR SERVICE DISRUPTION, EVEN IF BEEZIFI HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BEEZIFI'S TOTAL AGGREGATE LIABILITY FOR SECURITY-RELATED CLAIMS SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNT PAID BY THE CUSTOMER TO BEEZIFI IN THE THREE (3) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM OR (B) ONE HUNDRED DOLLARS ($100.00 USD).

This limitation of liability applies to the fullest extent permitted by applicable law and is in addition to, and not in lieu of, the limitations and disclaimers set forth in Beezifi's Terms of Service.

16. Contact

For security-related questions, vulnerability reports, or concerns about the security of your data, please contact us:

  • Security reports: security@beezifi.com
  • General legal matters: legal@beezifi.com
  • Mailing address: Beezifi Inc., Legal Department, United States

This Security Policy was last updated on May 1, 2026. We may update this policy from time to time to reflect changes in our security practices or in response to new threats and technologies. We will notify Customers of material changes via email or a notice within the Service.

© 2026 Beezifi Inc. All rights reserved.

Privacy Policy Terms of Service Security Policy