Security

Every application table has row-level security enabled in the database, and access is scoped to the business you belong to. One business can never read, change or delete another business's jobs, customers, photos or documents — the restriction is enforced by the database itself, not just by the app.

Bojit is served over HTTPS only, with HTTP Strict Transport Security enforced, so your connection is encrypted in transit and browsers refuse to fall back to an unencrypted one.

The site runs a nonce-based Content Security Policy, enforced in production. Scripts must be explicitly allowed by that policy — we do not permit unsafe-inline or unsafe-eval in our script policy, which closes off the most common route for injected code.

Job photos and generated quote and invoice PDFs are kept in private storage buckets. They are never given a public URL. When you or your customer views one, it is served through a short-lived signed link that expires on its own.

Authentication is handled by Supabase Auth, so passwords are never stored by the application itself. Our internal admin console rate-limits sign-in attempts and locks an account out temporarily after repeated failures.

Public endpoints — the contact form and the waitlist sign-up — are rate-limited per IP address to stop automated abuse.

Deleting a job or a customer is a soft delete first: the record moves to Trash where you can restore it, and is only permanently removed later by a scheduled purge. That means an accidental tap is recoverable rather than final.

Your database and file storage are hosted in the United Kingdom (London region).

Under UK GDPR you have the right to access and to port your data. Email support@bojit.app and we will provide an export. See our GDPR page for the full list of your rights.

If you believe you have found a security issue, please tell us at security@bojit.app. Our machine-readable contact details are published at /.well-known/security.txt.

We aim to acknowledge reports promptly. While testing, please do not access, modify or delete data belonging to other users, and please give us a reasonable chance to fix an issue before sharing it publicly.