The gist
- Found a problem? Tell us privately at security@billbook.com.au. Act in good faith and we'll work with you, not against you.
This summary helps you read the document. The full text below is what applies.
1. How we protect Billbook
Data is stored in Australia (Sydney), encrypted in transit and at rest, with extra encryption for tax file numbers and identity numbers. Each business and practice is separated at the database level. Everyone who signs in to any Billbook app must use two-step sign-in, and it can't be turned off. Practices also get a full audit log. More on our Security page.
2. Reporting an issue
Email security@billbook.com.au with what you found, how to reproduce it and what it affects. We aim to reply within 2 business days, keep you updated, and tell you when it's fixed.
3. Testing in good faith
- Only test against your own account and data.
- Don't access, change or delete other people's data. If you come across it, stop and tell us.
- No denial-of-service, spam, social engineering or physical testing.
- Give us a reasonable time to fix an issue before you talk about it publicly.
If you follow these rules, we won't take legal action against you for your research.