What BCDock does for security today, at the architecture level: tenant isolation, per-region Key Vaults, HTTPS environments, immutable provisioning logs. Plus a clear line between shipped and audited by a third party so partner-questionnaire and procurement teams know exactly what they are getting.
What's built and running in production, not what's planned. Each card describes the mechanism, not the marketing pitch.
Every database query in the Platform API carries a company-scoped filter applied automatically at the data-access layer. No per-query opt-out path. Cross-company access from a customer credential is structurally impossible.
Secrets partitioned by scope across three Key Vaults: platform-wide, core (shared TLS), and per-region. Each pool has just-enough access via managed identity. No long-lived Azure credentials in api-tier containers.
Each BC environment gets a unique Administrator password generated at provisioning, stored in regional Key Vault, never logged, never written to file. Surfaced via portal and `bcdock env get -o json`.
Portal sessions use httpOnly+SameSite=Lax cookies with 15-min access / 7-day refresh. CLI and agents use long-lived API keys with explicit scopes (env:read, env:write, usage:read, admin). OTP exchange is hashed and rate-limited.
Every environment is reachable at https://<env-name>-<shortId>.bcdock.io from the moment it's provisioned. Platform-managed wildcard TLS - customers never provision, rotate, or renew certificates.
Every stage of every provision, hibernate, resume, and delete writes an append-only line into the platform audit trail. No API surface edits or deletes log lines. Used for support investigations and post-mortems.
Hibernation snapshot blobs live in per-region Azure Storage with soft-delete enabled. If a blob is deleted, it is operator-recoverable for 7 days, then hard-purged. An operator-error safeguard, not a self-serve restore feature.
The environment, its admin password, and its hibernation backups live in the region you pick (US or AU), partitioned per-region. Your account and control-plane data - identity, billing, usage - live in BCDock's primary region, currently Australia, and are never copied across regions.
We are deliberate about the line between "in the architecture" and "audited by a third party." These are the things we'd rather tell you about now than have you find out later.
Azure (the underlying cloud) carries these certifications; BCDock at the platform level is best-effort. Pursuing certification is a future milestone, tied to at least one enterprise contract that justifies the audit cost.
Sandbox containers are not in scope for regulated-data regimes. Use synthetic or anonymised data only. Production workloads with regulated data must run on Business Central SaaS.
Internal review and standard hardening (Key Vault, RBAC, company-scoped query isolation, parameterised queries) is what's shipped. A formal third-party pen-test is timelined against early enterprise engagements.
If you've found something, please tell us before telling anyone else. Here's the contact, what to include, what we commit to in return, and how we triage by severity.
Include:
If it's sensitive, ask first and we'll arrange an encrypted channel.
| Severity | Examples | Target time-to-fix |
|---|---|---|
| Critical | Cross-tenant data access · auth bypass · secret leak · RCE on a pool VM | Hours-to-days |
| High | Privilege escalation · persistent XSS in portal | Days-to-1 week |
| Medium | Reflected XSS · CSRF (non-destructive) · non-PII info disclosure | 1-4 weeks |
| Low | Verbose error messages · missing security headers · cosmetic CSP | Next feature bundle |
These are guidance, not a contract. We make case-by-case calls and tell you what we're doing.