Security

This page describes how bklink is built and operated today. It is a factual description, not a contractual commitment — we improve these practices over time, and a page that froze our implementation into a promise would discourage exactly the changes that make the service safer. The binding commitments are in the Terms, the Privacy Policy and theData Processing Addendum.

Accounts and sessions

• Passwords are never stored. We keep a salted one-way hash using a slow, memory-hard derivation function with a high iteration count.
• Sessions are cryptographically signed, HTTP-only, Secure, and expire on a fixed schedule.
• Sessions are individually revocable. Changing your password signs out every device immediately.
• Password-reset links are single-use, short-lived, and only a hash of the token is stored — the database never holds anything that can reset an account.

Tenant isolation

Every query that reads customer data is scoped to the owning account at the database layer. The application is fail-closed by default: a new route is private unless it is deliberately added to a public allow-list.

Shared reports

A share link is a signed token that names exactly one report and one account. It expires, it can be revoked, and the page behind it is excluded from search engines and from our analytics. Because the link itself is the credential, treat it as confidential — anyone holding it can read that report until it expires.

Outbound requests

When we fetch a URL you submit, the request is screened first to prevent it being redirected at internal or private network addresses. Lookups that cannot be resolved are refused rather than attempted.

Data in transit and at rest

• All traffic is served over HTTPS. Plain HTTP is redirected.
• Database connections are TLS-encrypted.
• Backups are encrypted before they leave the backup job, and the key is held separately from the backup storage.

Backups and recovery

The database is backed up nightly and retained for 30 days. Recovery granularity is therefore approximately 24 hours — in a worst-case restore, work done since the last backup would be lost. Restores are tested rather than assumed. We tell you this plainly because a recovery objective you did not know about is not one you can plan around.

Monitoring

Application errors are reported to our monitoring provider with personal data, credentials and share tokens removed before transmission. Billing integrity is checked automatically: the ledger and every cached balance are reconciled on a schedule, and a disagreement raises an alert rather than being corrected silently.

What we do not currently have

Stated deliberately, because a security page that lists only strengths is not informative:

• No SOC 2, ISO 27001 or equivalent third-party audit.
• No 24/7 on-call rotation. We are a small operation.
• No customer-managed encryption keys.
• No formal penetration-testing programme.
• No single sign-on or multi-factor authentication yet.

If your procurement process requires any of these, tell us before you buy rather than after.

Reporting a vulnerability

Email support@bklink.uk with enough detail to reproduce the issue. We will acknowledge within five business days.

We will not pursue legal action against anyone who reports a vulnerability in good faith, gives us a reasonable opportunity to fix it before disclosing, and does not access, modify or delete data belonging to anyone else while investigating. We do not currently run a paid bounty programme.

Security incidents

If we become aware of a breach affecting your personal data, we will notify you without undue delay. For customers acting as data controllers, the Data Processing Addendum sets out the commitment in full — the binding obligation is without undue delay, with 48 hours as the target we run to where that is reasonably practicable. Our notice will describe what happened, what data was involved, what we have done, and what we recommend you do. We will notify regulators where the law requires it. See the Privacy Policy for how this interacts with your rights.