Security & Trust
Business Friendly, Inc. · Last Updated: September 17, 2026
This page explains how Business Friendly, Inc. ("Business Friendly," "we," "our") protects the data our customers and their business communities trust us with on the BusinessFriendly.ai platform (the Business Friendly Index). It is a plain-language companion to our Privacy Policy and Terms of Service, not a replacement for either.
Access controls
Every organization on the platform is isolated from every other organization; server-side authorization checks run on every request, not just in the interface.
- Roles. Within an organization, an owner or admin manages who has access. Organization roles (owner, admin, staff) govern what a person can see and edit; confidential business records are further restricted to a named project team where the organization sets that.
- Passwords. Passwords are never stored in plain text. We store only a PBKDF2-SHA256 hash (100,000 iterations, a unique random salt per account) — we could not recover your password even if compelled to.
- Sign-in and sessions. Every sign-in is a session recorded on our side. You can see where you are signed in and end any session; organization owners and admins can sign a member out everywhere. Changing or resetting a password ends your other sessions. Failed sign-in attempts are rate-limited to slow down password-guessing.
- Multi-factor authentication (MFA). Organization accounts can enable MFA using an authenticator app plus one-time recovery codes, with a controlled process to reset MFA if a device is lost.
- Single sign-on (SSO). Organization accounts can connect their own identity provider over OpenID Connect — Microsoft Entra ID, Google Workspace, or another standards-based OIDC provider — and, where the organization chooses, require it for sign-in.
- Security Center. Organization admins get a Security Center covering active sessions, sign-in history, MFA and SSO status, connected integrations, organization API keys, and recent permission and sharing changes.
- Organization API keys. Keys are scoped to specific resources, named, revocable, and rate-limited. We store only a SHA-256 hash of the key — the full key is shown once, at creation, and cannot be retrieved again.
- Webhooks. Outbound webhook payloads are signed (HMAC-SHA256) so a receiving system can verify they came from us.
- Audit log. Consequential actions — sharing changes, exports, API key and webhook changes, permission and security-setting changes — are written to an append-only audit log that application code never edits or deletes. Sign-in attempts, successful or not, are kept in a separate sign-in history that organization admins can review.
Encryption
- In transit. All traffic to businessfriendly.ai runs over HTTPS (TLS) through Cloudflare.
- At rest. Application data lives in Cloudflare D1 (SQL) and Cloudflare R2 (file storage), both encrypted at rest by Cloudflare.
- Sensitive tokens. Where we hold a credential on a customer's behalf — for example, an OAuth token from a connected Microsoft 365 calendar, or a webhook signing secret — it is separately encrypted (AES-GCM) with a key held as a Cloudflare Workers secret, not in the database in the clear.
Data & AI trust
Our full Data & AI Trust Standard covers source provenance, confidence, human approval and confidentiality levels in detail. In short:
- Where the platform uses AI to draft an answer, summarize a record, or analyze a document, the relevant customer content is sent to Anthropic's Claude API to generate that response. We send only the content needed for that request.
- Business records marked business confidential are restricted to the organization (and, where set, a named project team) — that visibility level is enforced on the server for every read, including AI features, so confidential information stays where its owner put it.
- AI drafts and analyzes; it does not make final decisions. Adverse classifications of a business, pricing and product changes, and anything sent externally pass through a named human before they take effect.
- AI-generated text on the platform is labeled.
Backup & disaster recovery
Our database runs on Cloudflare D1, which provides Time Travel: point-in-time restore of the database to any point in the preceding 30 days. We rely on this platform capability for disaster recovery of application data. Uploaded files (documents, recordings, images) are stored in Cloudflare R2.
Incident response
If you believe you have found a security issue affecting BusinessFriendly, or you are a customer reporting a suspected incident, contact consulting@businessfriendly.ai. We investigate reported incidents, and where a confirmed security incident affects a customer's data, we notify the affected customer without undue delay with the details we have and what we are doing about it.
Vulnerability disclosure
We welcome good-faith reports of security vulnerabilities in BusinessFriendly.
- How to report. Email consulting@businessfriendly.ai with enough detail to reproduce the issue (affected URL, steps, and impact). Please do not include real customer or respondent data in your report.
- Safe harbor. If you make a good-faith effort to report a vulnerability to us privately, avoid accessing or modifying data beyond what is needed to demonstrate the issue, avoid degrading service for others, and give us a reasonable opportunity to fix the issue before any public disclosure, we will not pursue legal action against you for that research and will treat your report as authorized.
- What to expect. We acknowledge reports and investigate them; we do not currently operate a paid bug-bounty program.
Our machine-readable disclosure contact is published at /.well-known/security.txt per RFC 9116.
Data retention, export & deletion
- Retention. We retain account and survey/business data for as long as an account is active or as needed to provide the service. If you close your account, tell us and we delete or anonymize your personal information, normally within 30 days of your request, and confirm when it is done. Security and audit logs, billing records, and anything we must keep by law are retained longer — see our Privacy Policy for the full policy.
- Export. You are not locked in. Depending on your plan, you can export your own data as a report (PDF, Word, or CSV), export your business list as CSV, export a selected map cohort as CSV, or pull records programmatically through the organization API.
- Deletion requests. To request access to, correction of, or deletion of your personal information, contact consulting@businessfriendly.ai.
Subprocessors
We use a limited set of subprocessors — companies that process data on our behalf to provide the service. See the current list, with what each one does and what data it sees, on our Subprocessors page.
Certification status
Business Friendly, Inc. is not SOC 2 certified, and we do not hold ISO 27001, HIPAA, or any other formal security certification today. We are working through an internal SOC 2 readiness program — tracking access review, change management, incident response, backups, vendor management, vulnerability management, logging, security policies, and staff access controls — as a step toward a future independent audit. We will update this page if and when that changes.
Questions about anything on this page? Contact us at consulting@businessfriendly.ai.