BIZC3
Start free trial
Security & trust

Built to protect your business data

BIZC3 is a multi-tenant business operating system that unifies HR, accounting, payroll visibility, projects, tasks, training, documents, messaging, and AI assistance in one platform. Protecting your data and isolating every company's information are foundational to how the product is built.

Data encryption

  • All network traffic is encrypted in transit using TLS/HTTPS.
  • Data is encrypted at rest at the database and file-storage layer.
  • The most sensitive fields — third-party OAuth tokens and personal data such as Social Security, bank account, and routing numbers — are additionally encrypted at the application layer using AES-256-GCM, with encryption keys stored outside the database.

Tenant isolation & access control

  • Each customer organization's data is isolated using PostgreSQL Row-Level Security (RLS), scoped by organization membership; isolation has been verified through adversarial SQL testing and live testing.
  • Sensitive data stores (personal and HR data, OAuth tokens, payroll and financial caches) use a deny-all posture, reachable only through controlled server-side paths and never directly from the browser.
  • Role-based permissions govern per-module access and field-level visibility; sensitive fields such as pay rates, SSNs, and bank details are masked unless a user is explicitly authorized.
  • Privileged operations follow least-privilege principles, and database grants exclude encrypted token columns from any client-readable access.

Authentication & secrets

  • End-user authentication is managed by a dedicated authentication provider.
  • Administrative and infrastructure accounts are protected with multi-factor authentication.
  • Application secrets and API keys are stored only in environment configuration and are never committed to source control; source code is maintained in a private repository.

Third-party integrations

  • Integrations with your accounting and payroll systems are strictly read-only and use official APIs; we never run payroll, move money, or write data back to these systems.
  • We do not use screen scraping, RPA, or any unofficial data-collection methods.
  • The only payment processing we perform is collecting BIZC3's own subscription fees through a PCI-compliant payment processor, which handles all card data.

Sub-processors

  • We rely on a vetted set of infrastructure, AI, billing, and integration sub-processors, each under contract and access-scoped to its function. A current sub-processor list is available to customers and partners on request.

AI data processing

  • AI features (the business coach, document Q&A, and bill scanning) call our AI provider's API server-side only; the API key is never exposed to the browser.
  • Tenant data sent to our AI provider's commercial API is not used to train models.
  • AI output is suggest-only — it never approves, pays, or saves; all output is reviewed by a person and re-validated server-side, and document and tool content is treated as untrusted input.
BIZC3 follows strong security practices but does not currently hold third-party certifications such as SOC 2. Healthcare and dental are supported, and a signed HIPAA Business Associate Agreement is put in place before any protected health information is processed.
Questions? Contact us.

Last updated June 2026