Trust center
Security & Trust
Security claims should be inspectable. This page describes the application controls currently in place and clearly separates implemented safeguards from certifications BlueTier does not claim.
- Effective and last updated
- Sections
- 12
- Reading time
- 4 min
On this page · 12 sections
Data minimization
- The onboarding form does not collect LinkedIn, Gmail, or other account passwords.
- LinkedIn account connectivity is session-based through an approved third-party connectivity provider; BlueTier never stores your LinkedIn password.
- Request bodies are size limited and validated against a schema before processing.
Authentication and sessions
- Dashboard sessions use signed, expiring tokens issued by the authentication provider.
- Two-factor authentication (TOTP) is available for dashboard sign-in.
- Secure cookies are used in HTTPS environments.
- Sign-in attempts and public endpoints, including the contact and onboarding forms, are rate limited.
- Authenticated APIs return no-store caching directives.
Customer-data isolation
Member data is isolated per organization. Isolation is enforced in the database with row-level security policies, so a query scoped to one organization cannot read another organization’s records, and every dashboard and API route is guarded by the same tenant checks.
Application and browser controls
- Content Security Policy and other security headers restrict browser capabilities.
- Cross-origin access is not broadly enabled.
- User-supplied content is validated and escaped before HTML rendering.
- Connected-provider webhooks are verified before they are queued for processing.
Encryption
Data is encrypted in transit using TLS across the public website, dashboard, and connected provider APIs. Data at rest on the managed Postgres data store is encrypted by the database provider.
Audit logging
Operator and account actions — including access to member records and changes to campaigns, connections, and settings — are recorded in an audit log with the actor, timestamp, and action taken. Audit records are retained under the account lifecycle policy and support access review, troubleshooting, and dispute resolution.
Error monitoring
Every runtime reports errors to an error-monitoring service so failures are seen and fixed. Error reports carry technical diagnostics; they are not used for advertising or profiling.
Breach notification
If we confirm a security breach affecting your personal data, we will notify affected members without undue delay and, where legally required, no later than 72 hours after confirming the breach. Notifications describe what happened, the data involved, and the steps being taken.
Access and service providers
Access is limited to authorized operators with a business need. The current production providers are Vercel (web hosting and serverless functions), Supabase (Postgres database and authentication; the content-management system uses the same database), Railway (always-on background worker), an approved third-party connectivity provider (LinkedIn, WhatsApp, Instagram, Telegram, and Gmail/Outlook/IMAP email account connectivity, plus an experimental Messenger or X connection if a member starts one, and access to the Google Calendar or Outlook calendar of a connected Gmail or Outlook mailbox when a member chooses it for scheduling), Stripe (payment processing), Calendly (meeting scheduling, where a member connects their own account), Cal.com (meeting scheduling, where a member connects their own account), OpenRouter (AI inference for drafts, summaries, and classification; Groq is retained as a fallback provider), Resend (transactional email: password resets, invitations, account notices, and booking confirmations), Google Sheets (operational lead-tracker mirror), and Sentry (error monitoring). The current list, roles, and data categories are published on the subprocessors page. Provider access and credentials are managed outside the public repository.
What BlueTier does not claim
BlueTier does not claim SOC 2, ISO 27001, PCI DSS, HIPAA certification, or another assurance status unless a current, verifiable statement is published here. BlueTier does not describe its security as “enterprise” or its privacy posture as “ready” or “compliant” in the abstract; the privacy policy describes our processing under the GDPR and comparable laws, and this page describes the controls in place. No website can promise absolute security.
Responsible disclosure
If you believe you found a vulnerability, email IT@bluetier.ai with “Security report” in the subject. Include the affected URL, reproducible steps, expected impact, and a safe way to contact you. Do not access other users’ data, degrade the service, use social engineering, or publish sensitive details before BlueTier has had a reasonable opportunity to investigate. We will not pursue legal action against good-faith security research conducted under this policy.
Member responsibilities
Members remain responsible for accurate authorization, internal approvals, their own devices and accounts, and compliance with third-party platform terms. Never send a password or verification code through the public contact or onboarding forms.
Questions or correction requests?
Use the contact form or email info@bluetier.ai. Never include an account password or verification code.
Contact