Security and safe-use practices

Members authenticate through the account provider. Server-side access checks restrict company records and private evidence to authorised company members. Platform-administrator functions require a separate administrator flag and all material actions create audit records.

Evidence files are held in private object storage and downloaded through an authenticated access check. Downloads use no-store and file-type hardening headers. File types and size are restricted at upload. Customers should redact information that is not needed for the requested service.

BBB App staff must never ask for CIPC, SARS, CSD or banking passwords, one-time PINs, CAPTCHA answers or full login credentials. The customer completes those protected steps directly. Report any request for them immediately.

Production controls include HTTPS, security headers, role-based access checks, private storage, payment-signature verification and audit events. We maintain a launch checklist for backups, restoration testing, access reviews, incident response and dependency updates.

Send suspected unauthorised access, unusual payment activity or privacy concerns to businessboxapp@gmail.com. Do not include passwords, OTPs or unnecessary identity information in the report.