Draft — pending legal review. This document has not yet been reviewed by a solicitor and does not constitute the final, binding version.

Security

Security is central to a platform that handles authentication and billing for your business. Here is an overview of how we protect the Badger Sett platform and your data.

Last updated: 13 July 2026

Authentication and access

  • Authentication is handled by Clerk, a specialist identity provider, rather than by rolling our own. This supports modern sign-in methods and secure session management.
  • Access within an organisation is governed by role-based access control (owner, admin, and member roles), so people only see and do what their role allows.
  • Signing in to Badger tools uses single sign-on with short-lived, signed tokens, so your credentials are not shared with individual tools.

Encryption

  • All traffic to the platform is encrypted in transit using TLS (HTTPS).
  • Backups are encrypted at rest.
  • Payment card data is handled entirely by Stripe and never touches our servers.

Hosting and data residency

The application, database, and backups run on Hetzner Online GmbH infrastructure within the European Union (Germany and Finland). Database backups are taken on a regular schedule and stored in encrypted object storage. Where we use providers outside the UK and EEA, approved transfer safeguards are in place — see our Sub-processors page.

Auditing and monitoring

  • Key actions — such as signing in, subscription changes, and team membership changes — are recorded in an audit log for accountability and troubleshooting.
  • We use automated error and performance monitoring to detect and respond to problems quickly.
  • Outbound integration webhooks are signed with HMAC signatures so receiving tools can verify they genuinely came from us.

Data protection

How we handle personal data is described in our Privacy Policy. Business customers can enter into our Data Processing Addendum, and our full list of sub-processors is public.

Reporting a vulnerability

We welcome reports from security researchers and act on them. If you believe you have found a security vulnerability in the platform, please email [email protected] with enough detail to reproduce the issue.

We ask that you:

  • Give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly.
  • Avoid accessing or modifying data that is not yours, and avoid actions that could degrade the service for others.
  • Do not run automated scanning that could disrupt the service.

Acting in good faith under these guidelines, we will not pursue or support legal action against you. Our machine-readable disclosure policy is published at /.well-known/security.txt.

Contact

For security questions, contact [email protected].