Your data is safe with us
Bildgaard is built with security at every layer — from the infrastructure up to the application. Here's exactly how we protect your business data.
Privacy & Compliance
GDPR
Rights supportedExport or delete your personal data from each product. A Data Processing Addendum is available on request. Data is processed in the United States under Standard Contractual Clauses.
CCPA
Rights supportedCalifornia residents can request access to or deletion of their personal data. See our Privacy Policy for details.
Data location
United StatesAll customer data is stored in Google Cloud's us-east1 region (South Carolina, USA).
Independent audits
Not yetBildgaard has not yet completed a SOC 2 or ISO 27001 audit of its own. Our hosting provider, Google Cloud, holds both. We'll update this page when that changes.
Security controls in depth
Defense in depth means no single failure can compromise your data. Here's how we layer protections.
Encryption
- All stored data encrypted at rest with AES-256 by Google Cloud
- All traffic served over HTTPS, with HSTS on every app
- Passwords hashed with bcrypt, never stored in plain text
Access Control & Identity
- Sign in with Google, or with email and password
- Use your Google account's 2-Step Verification when you sign in with Google
- Owner, admin and member roles, enforced on our servers
- Admins choose which products each member can use, also enforced on our servers
- See your active sessions and sign them out from your settings
Sign-in Protection & Logging
- Rate limits on sign-in and password-reset endpoints
- Accounts lock after 5 failed sign-in attempts in 15 minutes
- A reused sign-in token signs out the whole session
- Sign-ins, account changes and admin actions are logged
Infrastructure
- Hosted on Google Cloud in the us-east1 region
- Fully managed App Engine and Cloud Run, with no servers for us to patch
- Every query scoped to your company's account
- Infrastructure changes security-scanned before they apply
Data Governance
- You own your data
- Export your personal data from each product
- Delete your personal data on request
Backup & Recovery
- Point-in-time recovery for the last 7 days on every product database
- Delete protection on every product database
- Automated health checks after every deploy
Secure Development
How a change gets from a pull request to production.
Infrastructure
Bildgaard runs entirely on Google Cloud Platform, whose data centers and infrastructure are covered by Google's ISO 27001, SOC 2/3 and PCI DSS certifications.
- Single region: Google Cloud us-east1
- Point-in-time recovery within a 7-day window
- Delete protection on production databases
- Traffic served through Google's front end and its built-in DDoS protection
us-east1
Region
7 days
Recovery Window
AES-256
Encryption at Rest
15 min
Access Token Lifetime
Responsible Disclosure
We welcome reports from security researchers. If you discover a vulnerability in any Bildgaard product or infrastructure, please email security@getbildgaard.com with a detailed description. We commit to acknowledging receipt within 24 hours and providing a resolution timeline within 5 business days.
We will not pursue legal action against researchers who act in good faith, follow our disclosure guidelines, and do not access, modify, or delete customer data.
Questions about security?
We're happy to walk through how Bildgaard handles your data and to share our Data Processing Addendum.