Security

How We Protect Your Data

• Encrypted everywhere — every connection uses HTTPS (TLS), and browsers are told to never use anything else. Stored data is encrypted on disk, and the most sensitive parts (emails and phone numbers in your tables, the logins to your connected tools, messages, two-step sign-in keys) are encrypted again by us with keys kept apart from the database.
• Sign-in — passwords are never stored in readable form; three wrong tries lock sign-in for 15 minutes; your sign-in sits in a locked cookie the page can't read; at most three devices, and idle ones are signed out. Two-step sign-in is available to everyone and required for admins and consultants.
• Only the right people — each business sees only its own data, enforced by the database itself. A consultant can open only the clients assigned to them, and team members get only the role they were given (owner, developer, or view-only).
• Leaving is clean — removing a team member or deleting an account ends its sign-ins at once, and deleting an account deletes its data.
• Checked continuously — every change is scanned for known weaknesses and vulnerable packages before it goes live, and requests are rate-limited against scraping and attacks.

More on how we handle personal data is in the Privacy Policy, and the services that run the Platform are listed on Service Providers.

Report a Security Problem

Found a way to see data you shouldn't, or another security flaw? Please tell us at support@bolgroupglobal.com. Include what you found, the steps to see it, and what an attacker could do with it.

• We confirm we received it within 3 business days, and keep you posted until it's fixed.
• We aim to fix serious problems within 30 days.
• With your permission, we'll thank you by name once it's fixed.

Rules for Testing (Safe Harbor)

If you follow these rules in good faith, we won't take legal action against you, and we'll treat your research as authorized:

• Test only with accounts you created. Never open, change or delete anyone else's data.
• If you reach someone else's data by accident, stop, don't keep a copy, and tell us.
• No attacks that slow down or stop the service, no spam, and no tricking our staff or clients.
• Give us a reasonable time to fix it before telling anyone else.

In scope: getdataconsulting.com and api.getdataconsulting.com. Out of scope: the services we use (report those to them), and reports from automated scanners without a working example.

Certifications

The Platform runs on providers that are independently audited every year (see About → Security). BOL Group LLC doesn't hold its own certification yet. For a vendor security review, email support@bolgroupglobal.com.