Security Overview

SeroBook is built with security at its core. Your business data, customer information, and financial records are protected by industry-standard encryption, robust infrastructure, and comprehensive security practices. This page provides a complete overview of how we keep your data safe.

Platform Security Features

SeroBook implements multiple layers of security to protect your account and data:

• End-to-end encryption – All data is encrypted both in transit and at rest
• Two-factor authentication (2FA) – Add a second layer of protection to your account login
• Role-based access control – Control exactly what each team member can see and do
• Audit logging – Every significant action is recorded with timestamps and user attribution
• Automatic session management – Inactive sessions expire automatically to prevent unauthorized access
• IP allowlisting – Restrict dashboard access to specific IP addresses (available on Pro plans)
• Webhook signature verification – All outgoing webhooks are signed so you can verify their authenticity

Data Encryption

SeroBook employs encryption at every stage of data handling to ensure your information is never exposed in plaintext to unauthorized parties.

Encryption in Transit

All communication between your browser and SeroBook servers is encrypted using TLS 1.3 (Transport Layer Security). This ensures that data cannot be intercepted or read by third parties while it travels over the internet. Key details:

• TLS 1.3 with forward secrecy enabled on all endpoints
• HSTS (HTTP Strict Transport Security) headers enforced, preventing protocol downgrade attacks
• All HTTP requests are automatically redirected to HTTPS
• API endpoints require HTTPS; plaintext HTTP requests are rejected
• SSL certificates are managed and auto-renewed by our infrastructure provider

Encryption at Rest

Data stored in SeroBook's databases and file storage is encrypted at rest using AES-256 encryption. This means even if physical storage media were somehow compromised, the data would be unreadable without the encryption keys:

• Database encryption – All database volumes use AES-256 encryption with keys managed by our cloud provider's key management service
• File storage encryption – Uploaded files (CSV imports, images, documents) are encrypted with server-side AES-256
• Backup encryption – All database backups are encrypted before being stored, using separate encryption keys from the primary database
• Key rotation – Encryption keys are rotated on a regular schedule following industry best practices

Infrastructure and Hosting

SeroBook is hosted on enterprise-grade cloud infrastructure designed for high availability, security, and performance.

Hosting Environment

• Cloud provider – Hosted on AWS (Amazon Web Services) with primary infrastructure in US and EU regions
• Data isolation – Each customer's data is logically isolated at the database level, preventing cross-tenant access
• Network security – Virtual private clouds (VPCs), security groups, and network ACLs restrict traffic to only necessary communication paths
• DDoS protection – Automatic DDoS mitigation at the network and application layers protects against volumetric attacks

Backups

Your data is backed up automatically and redundantly:

• Continuous backups – Point-in-time recovery allows restoration to any second within the last 35 days
• Daily snapshots – Full database snapshots are taken daily and retained for 90 days
• Cross-region replication – Backups are replicated to a geographically separate region for disaster recovery
• Recovery testing – Backup restoration is tested quarterly to verify data integrity and recovery procedures

Uptime and Reliability

SeroBook targets 99.9% uptime. Our infrastructure includes automatic failover, load balancing across multiple servers, and health monitoring that restarts unhealthy services within seconds. You can view our real-time and historical uptime status at our public status page.

Authentication Security

SeroBook provides multiple layers of authentication security to protect your account from unauthorized access.

Password Requirements

• Minimum 8 characters with at least one uppercase letter, one lowercase letter, and one number
• Passwords are hashed using bcrypt with a high work factor before storage – we never store plaintext passwords
• Common and breached passwords are rejected during account creation and password changes
• Password reset links expire after 1 hour and can only be used once

Two-Factor Authentication (2FA)

Enable 2FA for an additional layer of security. When enabled, logging in requires both your password and a time-based one-time code from an authenticator app:

1. Go to Settings > Security > Two-Factor Authentication
2. Click Enable 2FA
3. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
4. Enter the 6-digit code to verify setup
5. Save your recovery codes in a secure location

Social Login

SeroBook supports login via Google and Microsoft accounts. These providers handle authentication on their end, meaning your third-party credentials are never shared with SeroBook. Social login inherits the security protections of your Google or Microsoft account, including any 2FA you have enabled there.

Session Management

SeroBook manages login sessions carefully to balance convenience with security:

• Session duration – Sessions last for 7 days of continuous activity. After 7 days, you'll be asked to log in again regardless of activity.
• Inactivity timeout – Sessions expire after 30 minutes of inactivity by default. This can be configured between 15 minutes and 4 hours in your security settings.
• Active sessions list – View all active sessions for your account under Settings > Security > Active Sessions, including the device type, IP address, and last activity timestamp.
• Remote logout – Terminate any active session from the sessions list. Use "Sign Out All Devices" to invalidate every session if you suspect unauthorized access.
• Device recognition – New devices or unusual login locations trigger an email notification to the account owner.

Security Certifications and Compliance

SeroBook adheres to recognized security standards and undergoes regular assessments:

• SOC 2 Type II – Our infrastructure provider maintains SOC 2 Type II certification, covering security, availability, and confidentiality controls
• GDPR Compliant – SeroBook is fully compliant with the EU General Data Protection Regulation. See our Privacy and GDPR guide for details.
• PCI DSS – Payment processing is handled by PCI DSS Level 1 certified processors (Stripe). SeroBook never stores, processes, or transmits raw credit card data.
• Penetration Testing – Annual third-party penetration tests are conducted by independent security firms, with findings remediated promptly
• Vulnerability Scanning – Automated vulnerability scans run weekly across our infrastructure and application code

Incident Response

SeroBook has a documented incident response plan to handle security events quickly and transparently:

Response Process

1. Detection – Automated monitoring, logging, and alerting systems detect anomalies and potential security events around the clock
2. Assessment – Our security team evaluates the severity and scope of the incident within 1 hour of detection
3. Containment – Immediate measures are taken to contain the threat and prevent further impact
4. Notification – Affected customers are notified within 72 hours of a confirmed data breach, as required by GDPR and our own commitment to transparency
5. Remediation – The root cause is identified and fixed, with a post-incident review to prevent recurrence
6. Post-Mortem – A detailed post-mortem report is published for significant incidents, describing what happened, the impact, and the steps taken to prevent similar events

Your Security Best Practices

While SeroBook provides robust platform security, your account's safety also depends on your practices:

• Enable 2FA – This is the single most effective step you can take to protect your account
• Use strong, unique passwords – Never reuse passwords across services. Consider using a password manager.
• Review team access regularly – Remove access for team members who no longer need it
• Keep your email secure – Your email is used for password resets, so protect it with 2FA as well
• Monitor your audit log – Periodically review the audit log for unexpected activity
• Log out on shared devices – Never leave your account logged in on a device others can access

Next Steps

Now that you understand SeroBook's security foundations:

• Learn about privacy and GDPR compliance
• Set up user permissions and roles
• Understand API rate limits