Security

What is built, and what we can and cannot see

Below is what is actually in the system. No intentions, and no certification we do not have.

We cannot read your books

Not for support, not by accident. That is not an agreement but a rule in the database: the tables holding your entries, invoices, bank lines, employees and payslips return zero rows to an administrator of Bon Buku. A test proves it across fourteen tables, on every change.

What we do see

That your company exists, with its name, address and CRIB, and who has access to it. We need that to create your account and to help when you cannot get in. Nothing further.

  • Every client behind their own wall — The separation is row-level security in PostgreSQL, enforced by the database itself. The role the application runs as cannot get around it.
  • Sensitive numbers encrypted — CRIB numbers, sedulas and bank account numbers are stored encrypted and masked on screen by default. They never appear in a URL, a log line or a default export.
  • Your session encrypted — A session is a row in the database. That row is encrypted, not merely encoded — a difference that only counts when somebody reads the table.
  • What is posted stays traceable — A posted entry does not change. A correction is a reversal or a credit note referring to the original, so you can always show what happened. Invoice numbers run without gaps.
  • No third parties on this site — No typeface from elsewhere, no analytics service, no captcha. A test checks on every change that nothing is loaded from outside — including in the e-mails we send.

Backups

A backup every night, encrypted, to a second store away from the server. Thirty days locally, thirty-five off-site plus a monthly copy. That second store is in Amsterdam, in the same region as the server.

Where your data sits

The server is in Amsterdam, inside the EU. That holds for the backups too.

What there is not

Bon Buku has no ISO or SOC certification. What is above is what has been built, not what somebody signed off. If you want to check it, ask — we will show you how it works.