Security and data protection
Our core application hosting, database and customer file storage are configured in EU regions. We operate the service in accordance with GDPR requirements. Where specialist providers may process limited information outside the EEA, appropriate data-transfer safeguards are used. Customers retain ownership of the content they provide.
Client sites and account data are protected by encrypted connections, role-based access controls, optional two-step verification and strict separation between customer accounts and data.
We run regular dependency and security-configuration scanning, monitored backups and external uptime monitoring, supported by documented incident-response and recovery procedures. Our security programme is aligned with ISO/IEC 27001 as a reference framework; BadPigeon is not currently ISO/IEC 27001 certified.