Security that covers every app
You trust us with contracts, signatures, invoices and your business website. One account means one place to protect, so we built it carefully. Here is how.
Encryption
Every connection uses TLS (HTTPS), and HSTS tells browsers never to connect without it. Our database and file storage providers encrypt data at rest. Authenticator secrets, and payment provider credentials you connect in BooksBat, are also encrypted by the application.
Passwords
Passwords are hashed with scrypt and a unique salt, and are never stored or logged in plain text. Changing or resetting your password signs out every other session in every app.
Two factor authentication
Turn it on once on OfficeBats and every Bats app asks for a code from your authenticator app at sign in. Ten single use recovery codes, stored only as hashes, keep you from being locked out. Code attempts are rate limited.
One sign in, done carefully
Apps receive a one time code that works for 60 seconds and only for that app's registered return address. Sessions use random, signed, HttpOnly cookies. Sign in and password reset are rate limited per network and per account.
Sign out everywhere
One button ends every session in every app and on every device, for example after a lost laptop.
Application security
A strict Content Security Policy, frame protection and hardening headers, cross site request protection on every change, and outgoing requests checked so they cannot reach private networks. Error messages never include internal details and logs never contain passwords, tokens or document content.
Documents and signatures
Every file, envelope, form and share link is checked against its owner on each request. Guest uploads are processed in memory and deleted. Completed envelopes are sealed with a digital signature and SHA-256 hashes so any later change can be detected.
AI with care
AI features send only the content you choose to AI service providers that do not train on API data. We do not use your content to train AI models. Buildan.app's AI works on a copy of your site and nothing is published without your approval.
Operations and backups
Production access is limited to a small number of people and admin accounts are expected to use two factor authentication. Dependencies are kept up to date. Backups are encrypted at rest and age out on a rolling schedule. Our providers (Fly.io, MongoDB Atlas, Cloudflare, Resend and Stripe) maintain their own security certifications.
Your security checklist
- Use a long, unique password for OfficeBats. A password manager makes this easy.
- Turn on two factor authentication and save your recovery codes somewhere safe.
- Confirm your email address so you can reset your password.
- If a device goes missing, use Sign out everywhere and change your password.
Report a vulnerability
If you find a security issue in OfficeBats or any Bats app, email [email protected] with the steps to reproduce it. Please do not access other people's data, run denial of service tests or send spam, and give us reasonable time to fix the issue before you share it. We reply within 3 business days.
Effective November 12, 2026. For how we handle personal information, see the Privacy Policy.
Protect every app in one place
Create your OfficeBats account and turn on two factor authentication once for PDFbat, DocsBat, FormsBat, BooksBat, Buildan.app, SlidesBat and SheetsBat.