How Birdy keeps your data secure
Each company's data is kept apart and checked on every request. Here is what is in place, and what is not yet.
Updated
What is in place today
Every company's data is kept apart
Every request names the company it is for, and the server checks that you belong to it before anything is read or written. With no company, a request sees nothing.
Tested with two companies
An automatic test signs in as one company and tries every company screen against another, to prove one cannot see the other.
Two-factor sign-in
Sign in with an authenticator app code as well as your password. New companies require it for owners and office staff by default, and owners choose which roles must use it.
Each role sees what it needs
Owner, office, sales, crew lead and tech each have their own permissions. A sales rep sees only their own leads and quotes, and a tech sees only their crew's jobs.
Sign-in is rate limited
Repeated password and two-factor attempts are slowed down per account and per address, and passwords must be at least 12 characters.
Sessions stay on the server
Sessions are kept encrypted on our servers. The browser holds only an HttpOnly cookie, renewed at sign-in and ended at sign-out.
Encrypted in transit
Every page and every request goes over HTTPS, TLS 1.2 or newer.
Sensitive fields encrypted at rest
Two-factor secrets, tax IDs and gate codes and other property access notes are encrypted in the database.
Changes are recorded
Changes to records are written to an audit log with what changed, and every data import is recorded.
Strict browser rules
Every page sends a strict content security policy and refuses to be framed by other sites, except the booking page you choose to embed.
Your data is yours
Owners and office staff can export the customer list as a spreadsheet at any time.
No card numbers
Birdy does not store card numbers. Card payments are coming, and will be handled by a payment processor.
Not in place yet
We would rather tell you than have you assume. These are not done today.
- An outside security audit or certification (we do not claim one).
- Single sign-on with your company's identity provider.
- A screen listing your signed-in devices, and signing a team member out of every device at once.
- A check of new passwords against known breached passwords.
- Automatic sign-out after a set time idle.
Found a problem?
Found a security problem? Tell us through the contact page and we will reply quickly. Please do not test against other companies' data.
Security questions
Is my company's data kept separate?
Yes. Every request names the company it is for, and our servers check that you belong to that company before anything is read or written. With no company, a request sees nothing. An automatic test walks every company screen with two companies to prove one cannot see the other.
Does it have two-factor sign-in?
Yes. Two-factor sign-in with an authenticator app is built in, and new companies require it for owners and office staff by default. You choose which roles must use it.
Can I get my data out?
Yes. Owners and office staff can export the customer list as a spreadsheet file at any time.
See it on your own customers
Create your account. We set it up with you, with your customers and your price list, before your team starts.