Security

Beksa holds access to customers' advertising budgets, so security is a property of the architecture, not an add-on. Three rules: secrets never reach the browser; every organization is isolated; every change leaves a trace.

• All traffic is HTTPS only (HSTS with preload). Platform access tokens are stored encrypted with AES-256-GCM; the encryption key lives outside the database.
• Passwords are scrypt hashes with individual salts. Sessions are stored server-side as HMAC digests; the session cookie is HttpOnly, Secure and host-bound; signing out ends the session on the server, and a password change ends all sessions.
• One-time links in emails (address confirmation, password reset, invitations) are time-limited and expire after use.
• Database backups are performed by the provider and encrypted at rest.

• Organizations' data is separated on every request: a user receives only what their role allows. An attempt to open someone else's object returns “not found” without revealing that it exists.
• Roles: organization owner and administrators, managers and viewers in workspaces. Only administrators with a confirmed email can connect ad accounts and invite people.
• Every modifying action — connections, publishing, changes to rules and roles — is written to an audit log with the user, time and IP address.

• A strict Content Security Policy with a per-request nonce, no framing, and protective Referrer-Policy, Permissions-Policy and X-Content-Type-Options headers.
• Rate limits on sign-in, registration, password reset and email sending.
• Platform authorization goes through the official OAuth dialogs with single-use state and PKCE where the platform supports it; each connection is bound to a specific user and organization.
• Dependencies are checked for known vulnerabilities on every build; no secrets are kept in the repository.

The application runs on Vercel, the database is Neon (PostgreSQL), creative files are stored in Vercel Blob, and email goes through Resend. These providers hold SOC 2 certifications and publish their own security documentation. We run no servers of our own and keep no data on employee devices.

If you find a vulnerability, email support@beksa.app with “security” in the subject. Describe the issue, steps to reproduce and possible impact. We acknowledge reports within 2 business days, keep you informed of the status and thank you for responsible disclosure.

Please do not exploit the issue beyond what is needed to demonstrate it, do not access other customers' data and do not publish details before a fix is in place. There is no bounty program at this time.