Security - BBU Cleaning Work Order System

Enterprise-Grade Security

The BBU Cleaning Work Order System is built with security as a top priority. We employ industry-standard security practices, encryption, and access controls to protect your data.

Security Standards

HTTPS/TLS OAuth 2.0 SHA-256 Hashing RBAC Encrypted Storage Edge Security

Data Encryption

Data in Transit

✅ HTTPS/TLS 1.3 encryption
✅ All API calls encrypted
✅ Secure WebSocket connections
✅ No unencrypted HTTP traffic

Data at Rest

✅ Cloudflare D1 encrypted storage
✅ Passwords hashed with SHA-256 + salt
✅ OAuth tokens encrypted
✅ R2 object storage encryption

Authentication & Authorization

Password Security

SHA-256 Hashing: Passwords are hashed with cryptographic salt
No Plain Text Storage: We never store passwords in readable form
Password Complexity: Minimum 8 characters recommended
Session Timeout: Automatic logout after inactivity

Session Management

Secure Cookies: HTTP-only, SameSite=Strict, Secure flag
Session Tokens: Cryptographically random UUIDs
Token Rotation: Automatic refresh for QuickBooks OAuth
Logout on All Devices: Invalidates all sessions

Role-Based Access Control (RBAC)

Four user roles with granular permissions:

ADMIN

Full system access, user management, QuickBooks

MANAGER

Work order approval, reports, customer management

CLEANER

Assigned work orders, time tracking, photos

USER

Read-only access, basic viewing

QuickBooks OAuth 2.0 Security

Our QuickBooks integration uses industry-standard OAuth 2.0 protocol:

Authorization Code Flow: Secure token exchange (no credentials exposed)
Encrypted Tokens: Access and refresh tokens stored encrypted
Automatic Refresh: Tokens refreshed before expiration (24-48 hours)
Revocable Access: Disconnect at any time from System Settings
Scope Limitation: Only requests accounting permissions needed
State Verification: CSRF protection via state parameter

Production Credentials Verified: Using Intuit Production OAuth endpoints

Infrastructure Security

Cloudflare Edge Network

DDoS Protection: Automatic mitigation of attacks
WAF (Web Application Firewall): Blocks malicious requests
Rate Limiting: Prevents abuse and brute force attacks
Global Edge Deployment: Low latency, high availability
SSL/TLS Certificates: Automatic issuance and renewal

Database Security (Cloudflare D1)

SQLite Globally Distributed: Data replicated across regions
Prepared Statements: SQL injection prevention
Access Control: Only app workers can access database
Automated Backups: Point-in-time recovery

File Storage Security (R2)

S3-Compatible Storage: Industry-standard object storage
Encrypted at Rest: All files encrypted
Private Buckets: No public access by default
Signed URLs: Temporary access to authorized users only

Security Best Practices for Users

Password Recommendations

✅ Use at least 12 characters
✅ Mix uppercase, lowercase, numbers, symbols
✅ Don't reuse passwords from other sites
✅ Use a password manager
✅ Change passwords periodically

Device Security

✅ Keep browser updated
✅ Use antivirus software
✅ Avoid public Wi-Fi for sensitive tasks
✅ Lock your device when unattended
✅ Log out after each session

Phishing Alert: Never share your password via email or phone. BBU Cleaning will never ask for your password.

Incident Response

If you suspect a security incident:

Change Your Password Immediately: Log in and update credentials
Report the Incident: Contact security@bbucleaning.com
Review Account Activity: Check for unauthorized actions
Monitor for Suspicious Activity: Watch for unusual behavior

Security Contact: security@bbucleaning.com | Emergency: (555) 123-SECURE

Compliance & Auditing

Audit Logs: System tracks user actions and changes
Data Retention: Complies with legal requirements
GDPR/CCPA Compliance: User rights respected (access, deletion)
Regular Security Reviews: Periodic security assessments
Vulnerability Scanning: Continuous monitoring for threats

Security Updates

We continuously improve security:

Dependency updates applied regularly
Security patches deployed promptly
Zero-day vulnerabilities addressed ASAP
Cloudflare automatic updates and protections

User Manual Privacy Policy Terms & Conditions Contact Support