Security at Basenautic
Your bookings, client passport details and payments are your business. This page describes how we protect them — only measures that are in place today.
Questions about security or data protection? Write to contact@basenautic.com. See also our Privacy Policy.
Your data stays in the EU
- The application and its databases run on Amazon Web Services in Ireland.
- Uploaded files are stored on Cloudflare R2 in the EU jurisdiction.
- Error reports go to Sentry's EU data region (Germany).
- Basenautic is run by a Greek company in Thessaloniki.
Every company is kept apart
- Each company has its own separate database — your records are never in the same tables as another company's.
- Files are stored in a separate area per company. The storage is private: files are only downloaded through the app, after sign-in and a permission check.
Secure sign-in
- Passwords are stored only as bcrypt hashes, never in readable form.
- Two-factor authentication with an authenticator app, with backup codes. Administrators can make it mandatory for all administrators.
- Sign-in attempts are rate-limited, and sign-up is protected by a bot check.
- You get an email when your account is used from a new IP address.
- See every device where you are signed in, and sign out one device or all others with one click.
Control inside your company
- Roles and permissions per page: decide who can view, edit or delete.
- An activity log shows who changed what, and when.
- Deleted records go to a recycle bin first, so mistakes can be undone.
Protected connections
- HTTPS everywhere.
- Traffic passes through Cloudflare (DNS, content delivery, web application firewall).
- Strict security headers and a Content Security Policy on the app.
- Card payments are handled by Stripe; card details never reach our servers.
Encrypted backups
- Every night, all databases are backed up and encrypted with AES-256 before they leave the server, and each backup is checked after it is written.
- Backups are kept for 14 days on the server and copied to a separate EU storage location, where they are kept for 90 days.
- Uploaded files are also copied every night to that separate backup location.
Your data, your decision
- Export your data at any time: Excel, PDF, Word and JSON.
- The company owner can delete the whole company account from Settings. There is a 10-minute window to cancel; after that the company's database and files are permanently deleted.
- Deleted data disappears from backups as they expire (14 days on the server, 90 days off-site).
If something goes wrong
- Errors are reported to us automatically so we can fix them quickly.
- If a security incident affects your data, we inform you without undue delay — where possible within 48 hours — and the authorities as the law requires.
Report a vulnerability
Found a security issue? Email contact@basenautic.com with the details. Please do not access other customers' data, and do not run tests that could disrupt the service. We reply as soon as possible, normally within 3 working days, and we will keep you updated until it is fixed.
security.txt