Each operator's records sit in a database of their own, and card details go straight to Stripe.
We create each database in the region for the operator's country, and every database is encrypted at rest.
Where your data is stored
An operator's database is created in the region for the country given at sign-up.
| Operator country | Database location |
|---|---|
| United Kingdom | AWS eu-west-2, London |
| Ireland, Switzerland and the EU | AWS eu-central-1, Frankfurt |
Documents for UK and EU operators are stored in the European Union. Sign-in details are held by Stytch in the United States: names, email addresses, organisations, phone numbers that members add, and sessions.
How we protect it
- Card payments
- Card details are entered in Stripe's payment form and go from the browser straight to Stripe, a PCI Service Provider Level 1. Bagdock keeps the card brand, the last four digits, the expiry date and a Stripe reference.
- Separate databases
- Each operator's business records are kept in a database of their own. Renter accounts sit in the marketplace database for the renter's region.
- Sign-in
- Your team signs in through Stytch with a magic link sent by email, or with Google or Microsoft. Sessions are kept in secure, HTTP-only cookies.
- Connected accounts
- Tokens for the accounts you connect are encrypted with AES-256-GCM before they are stored. Each token has its own key, which a key held in a key management service encrypts in turn.
- At rest
- Our databases are encrypted at rest with AES-256.
- In transit
- Connections to Bagdock's websites and apps use HTTPS, and connections to our databases require TLS.
Report a vulnerability by email to security@bagdock.com.
Questions operators ask about security
Do you hold ISO 27001 or SOC 2?
Not yet. Bagdock does not hold either certification.
Do you support single sign-on?
Not yet. Your team signs in with a magic link, Google or Microsoft.
Who handles card details?
Stripe. Card details are entered in Stripe's payment form and go straight to Stripe.