Security at BobsWork

Data Encrypted at Rest and in Transit

Every BobsWork page serves over HTTPS-only with HSTS preload. Data is encrypted in the database with the same Postgres-encrypted-at-rest offered by Neon. Backups inherit that encryption and a 30-day retention policy.

• TLS 1.3 on every public endpoint
• Database-level encryption (AES-256) for tenant data
• Backup rotation every 24 hours, 30-day retention

Authentication Is Built for Executives

Every account ships with multi-factor ready out of the box. We recommend turning it on the day you sign in. We never store passwords in plaintext — bcrypt hashing only — and we never email them back.

• TOTP-based MFA with single-use backup codes
• Account lockout after 5 failed attempts, with notification email
• Per-device session list with one-click revoke from your profile

Set up MFA →

Permissions Are Workspace-Scoped

Workspaces are isolated. Members see only what their role allows, and every permission change is recorded in an append-only audit log your admin can review at any time.

• Three workshop roles — owner, contributor, viewer
• BobConnect credentials are encrypted per-connection, scoped to the workspace
• Tool permissions audited and revocable from one page

Open Security Center →

Payments Run on Stripe Connect — Never Stored Here

BobsWork never touches raw card numbers. All payment flows run on Stripe Connect in our merchant or marketplace model, with Webhook signatures verified on every Stripe event we accept.

• Stripe Webhook signatures verified per-event (constructEvent)
• Idempotency keys prevent duplicate orders on replays
• Bob's Cash wallet values are kept in your region — no funds cross-platform

Privacy Policy

Read the full privacy policy for details on what we collect, how we use it, and how you can export or delete it.

Read the privacy policy →