Authentication & Identity
Two-step sign-in enforced by the database. Passkeys, no shared logins.
Bayside / Security
Security & CompliancePosture: Enforced
Enterprise-grade, by default.
Our systems hold data and move money. Security is the design constraint.
Controls protecting millions of production records are the baseline — including for yours.
The posture
Six domains. One standard.
In place from day one.
Data Protection
Encrypted in transit and at rest. Codes and links stored only as hashes.
Tenant Isolation
Row-level security on every table, switched on automatically.
Integration Security
Webhooks signed and verified (HMAC-SHA256, Ed25519) with replay windows.
Messaging Compliance
CTIA opt-outs, 10DLC registration, per-contact consent.
Monitoring & Audit
Event logs and audit trails on every system, with alerts on sensitive actions.
What we implement
The controls, specifically.
Switched on in a platform we recently shipped and run, and what we bring to yours.
Sign-in & sessions
- Two-step sign-in, enforced by the database. Until a session passes the second step, every query, file and live update is refused.
- Passkeys and trusted devices. A passkey, a one-time email code, or approval from a device you already use.
- Device keys that can't be copied. Remembered devices sign each sign-in with a key the browser can't export.
- Short-lived sessions. 15-minute access tokens. Refresh tokens rotate on every use, and a reused one ends the session.
- Re-confirm for anything sensitive. Security changes need a recent sign-in. Leaked passwords are rejected.
Data & access
- Row-level security on every table. Switched on automatically for new tables, and it can't be turned off.
- Least-privilege roles. Each role reaches only what it needs. Security tables are server-only.
- Nothing sensitive in the clear. One-time codes, sign-in links and device secrets are kept only as hashes.
- Expiring links. Files live in private storage. Download links expire in 60 seconds.
- Card data never touches the app. Payments run through a hosted card form.
Edge & integrations
- Signed webhooks. HMAC-SHA256 with a separate key per source and a 5-minute replay window.
- Rate limits and lockouts. Caps per IP and per user. Ten bad secrets in ten minutes locks the IP out.
- Block lists. Known-bad IPs are refused on every request.
- Hardened browser headers. Strict CSP, HSTS with preload, no framing, and an allowlist of origins.
- Secrets stay server-side. The build fails if a secret ever lands in the browser bundle.
Monitoring & proof
- Security event log. Sign-ins, codes, devices and policy changes, with IP and browser.
- Alerts by email. New-device sign-ins, repeated wrong codes, blocked sign-ins and every admin action.
- Append-only records. Balances live in an append-only ledger. E-signatures keep a hash of the signed document.
- Tested, not assumed. 42 automated security and access-control test suites, and pinned dependencies.
Compliance posture
Built to your compliance target.
C-01SOC 2 Type 2
C-02ISO 27001
C-03HIPAA-capable
Held at the infrastructure layer, inherited by every system.
Working with your security team
- Alignment
- SOC 2, HIPAA, or your internal bar
- Documentation
- Controls, data flows, access models
- Environment
- Built inside your cloud accounts
- Review
- Security review and agreements
- Ownership
- Fully yours, fully auditable