Security
Business Vault holds important operational information about the digital assets businesses depend on. Protecting that information is a core part of how the platform is built and operated.
Controls
Passwords are hashed with Argon2id. Multi-factor authentication is available for Business Vault accounts. Sessions use HTTP-only cookies, can be revoked, and state-changing requests require an application CSRF header. Password reset uses time-limited tokens.
Public traffic is served over HTTPS/TLS. Evidence files are encrypted before they are written to storage. Integration credentials and refresh tokens are encrypted server-side and are not exposed in the browser.
Business Vault is a multi-tenant platform. Organisation data is separated and access is controlled through authenticated roles and permissions. Agency users only see clients they are authorised to manage.
Evidence documents are stored privately with version history and content hashing. Downloads use short-lived signed links and are written to the audit log. Access follows organisation permissions.
Supported services use their official authentication or API mechanisms where available. Integration credentials stay on the server. Third-party passwords are not stored.
Important actions are recorded, including sign-ins, permission changes, evidence access, integration changes and administrative actions.
Infrastructure
Business Vault runs on Contabo GmbH infrastructure in Germany. The application database is PostgreSQL on the same environment. Evidence files are stored on encrypted local application storage on that host. Transactional email is sent through the Business Vault mail configuration for businessvault@businessvault.space.
Database and application storage are included in the host backup process operated for the Business Vault deployment. Retention and restore procedures are managed by the platform operator.
Public website scans refuse private and link-local addresses. A check that has not been run is shown as unknown, not healthy.
Report security concerns to businessvault@businessvault.space. Recovery support requests can also be submitted through the contact form.
Business Vault helps businesses reduce digital risk and improve recovery readiness. It does not make a company impossible to compromise, and it does not replace endpoint protection, network security or specialist incident-response services.
Contact Business Vault support with the details of your enquiry.
