Security at BizConnect.id
A plain description of how the hosted service is built and run. Nothing here claims a certification we do not hold.
Hosting
- Provider and regionThe service runs on Railway in the Singapore region.
- One database per workspaceEach customer workspace has its own isolated database. No table is shared between customers.
- TLS in transitTraffic between your browser and our edge is encrypted with TLS. The edge redirects plain HTTP to HTTPS and sets HSTS. Behind the edge, traffic stays on the hosting provider's private network.
Where your data lives
Today, all of it is in Singapore: compute, databases, files and backups. None of it is stored in Indonesia.
| Component | Location |
|---|---|
| Compute | Singapore |
| Database | Singapore |
| Files | Singapore |
| Backups | Singapore |
If your organisation needs its data on Indonesian soil, we offer on-premise deployment under a separate contract. Talk to sales about it.
Contact salesData storage
- Files and backupsStored in an S3-compatible object store in Singapore.
- Per-workspace prefixEvery workspace writes under its own key prefix in the object store.
Backups
- DailyEvery workspace is backed up once a day.
- EncryptedBackups are encrypted with a passphrase that no workspace can read.
- Offsite copyA copy is kept in object storage, separate from the servers that run the service.
- 30-day retentionBackups are kept for 30 days.
Access control
- Role-based permissionsAccess inside a workspace is granted by role.
- Module profilesModule profiles limit which parts of the system each user sees.
- Two-factor authenticationAvailable for every user.
- API keysAn API key carries the permissions of the user it belongs to, and every use of a key is logged.
- Platform accountsWorkspace administrators cannot create or change API keys for platform accounts.
Platform separation
- Control planeProvisioning, billing and account management run on a separate site with its own database.
- No workspace accountsWorkspace users have no account on the control plane.
Monitoring
- External checksThe service is checked over HTTP every 60 seconds from outside the application environment.
- Status pageResults are published on the status page.
- AlertingFailed checks raise an alert to our team.
Vulnerability management
- Internal security sweepsWe run internal security reviews of the platform and its applications.
- Dependency auditsDependencies are checked against the OSV vulnerability database during each security review.
- Upstream patchesSecurity fixes from the upstream open-source projects are ported into our code.
Sub-processors
These third parties process customer data on our behalf. Changes are announced 30 days in advance under the Data Processing Agreement.
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway | Hosting and object storage | Singapore |
| Midtrans | Payment processing | Indonesia |
| Google Workspace | Transactional email | — |
| AI model providers | Optional AI Assistant add-on only | — |
| Kuncie / Aiconec door-access service | Optional Office Lounge app only | — |
A location is shown where the sub-processor's processing region is fixed.
Responsible disclosure
If you believe you have found a vulnerability in BizConnect.id, email security@aiconec.com. Include the steps to reproduce it. We will acknowledge your report and keep you informed while we work on a fix.
Please do not access data that is not yours, do not run denial-of-service tests, and give us reasonable time to fix the issue before publishing it.
Certifications
BizConnect.id does not hold ISO 27001 or SOC 2 certification today. ISO 27001 certification is planned once enterprise volume justifies it. This page describes the controls we actually run; our written commitments are in the Service Level Agreement and the Data Processing Agreement.