Security Built Into the Platform.
How Baselign protects your accounts, your team and the records you keep, from sign-in to storage.
How We Protect Your Data
Two-factor authentication
Any user can turn on two-factor sign-in with an authenticator app such as Google Authenticator or Authy. A one-time recovery code is shown once for use if the device is lost.
Passwords and secrets
Passwords are stored as bcrypt hashes, never in plain text. Recovery codes are hashed too, and two-factor secrets are encrypted at rest with AES-256-GCM.
Verified accounts and sessions
Email addresses are verified before sign-in. Each user can see every device that is signed in, with its IP address, and end any session.
Rate limiting
Rate limiting per signed-in session and per IP address, plus controls on real-time connections, protects the platform from automated abuse.
Permissions and audit trail
Access is set per area, from View Only to Full Access. Changes are recorded in histories on each record, and the full activity log exports as a CSV with user, action, IP address and device.
Hosting and data location
Servers and databases are hosted with Hetzner in the EU, over HTTPS. Uploaded files are stored with Cloudflare. Payments are handled by Stripe, so we never receive or store card details.
Questions From Your IT or Procurement Team?
Baselign is operated by Gravity Works Limited. The Privacy Policy lists the providers we use and how data is handled and retained. If your organisation needs more detail for a supplier or security review, get in touch and we'll go through it with you.
Common Questions
See It With Your Own Team.
Start a free trial, or get in touch and we'll answer any security questions directly.