Security

Data protection

We collect and retain only the data our services need to function, and we handle personal data in accordance with UK data protection law (UK GDPR and the Data Protection Act 2018). Access to production data is restricted to authorized personnel on a need-to-know basis. See our Privacy Policy for details of what we collect and why.

Encryption

All traffic between users and our services is encrypted in transit using TLS. Internal service-to-service communication across untrusted networks is likewise encrypted. Credentials and secrets are stored outside of source code and rotated when personnel or systems change.

Infrastructure security

• Services run on hardened Linux hosts and containers with minimal installed surface.
• Access follows the principle of least privilege; administrative access requires key-based authentication.
• Systems are patched on a regular cadence, with expedited patching for critical vulnerabilities.
• Network-level controls (firewalls, allowlists, and rate limiting) restrict exposure of internal services.
• Services are monitored continuously, with alerting for anomalous behavior and availability issues.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in any Boratech product or system, please email [email protected] with the subject line “Security disclosure”, including enough detail for us to reproduce the issue.

• We will acknowledge your report and keep you informed of remediation progress.
• We ask that you do not access or modify data belonging to others, degrade the service, or publicly disclose the issue before we have had a reasonable opportunity to fix it.
• We do not pursue legal action against researchers who report issues in good faith within these guidelines.

Incident response

We maintain an internal incident response process covering detection, containment, remediation, and post-incident review. Where an incident affects users' personal data, we assess notification obligations under applicable law and inform affected users and authorities as required.