Security Policy

The Successful Bookkeeper Global Inc., doing business as BKOS ("BKOS"), takes the security of your data seriously. This Security Policy describes the measures we take to protect your information and the shared responsibility you have as a BKOS member.

1. Our Commitment

We design and operate the BKOS platform with security as a foundational consideration. Our approach includes people, processes, and technology controls aligned with industry best practices.

2. Infrastructure Security

• Encryption in transit: all data transmitted between your device and BKOS servers is encrypted using TLS 1.2 or higher;
• Encryption at rest: sensitive data stored on our platform is encrypted at rest;
• Access controls: access to production systems is restricted to authorized personnel on a need-to-know basis, protected by multi-factor authentication;
• Network security: we use firewalls, intrusion detection, and network segmentation to limit exposure;
• Data backups: member data is backed up regularly; backups are encrypted and stored securely.

3. Application Security

• Authentication: account access requires a verified email address and password. Multi-factor authentication (MFA) is available and recommended;
• Session management: sessions expire after a period of inactivity and can be logged out remotely from account settings;
• Input validation: the platform validates and sanitizes all user-submitted data to protect against common web vulnerabilities (injection, cross-site scripting, etc.);
• Dependency management: we regularly review and update third-party software components to address known vulnerabilities.

4. Organizational Security

• Team training: all team members with access to member data receive security training;
• Vendor management: third-party service providers are evaluated for security practices before being granted access to member data. Data processing agreements are in place where required;
• Incident response: we maintain an incident response plan. In the event of a confirmed data breach affecting your personal information, we will notify you in accordance with applicable law.

5. Your Responsibilities

Security is a shared responsibility. As a BKOS member, you help protect your account by:

• Using a strong, unique password for your BKOS account;
• Enabling multi-factor authentication;
• Not sharing your login credentials with others;
• Logging out of shared or public devices after use;
• Being cautious of phishing attempts — BKOS will never ask for your password by email;
• Reporting suspicious activity to security@bkos.io promptly.

6. Reporting a Security Issue

If you believe you have identified a security vulnerability in the BKOS platform, please report it to us responsibly. See our Vulnerability Disclosure Policy for guidance.

For general security concerns: security@bkos.io

7. Updates to This Policy

We review and update this Security Policy periodically as our practices evolve. Material changes will be communicated through the Service.

8. Contact