Application Security
Bitaic protects monitoring workspaces with secure development practices, scoped access controls, encrypted transport, managed encryption at rest, audit coverage, and incident-response workflows. This page summarizes the security baseline that applies across the public docs.
Development And Release Controls
- Source changes go through version control, review, validation, and release approval before production deployment.
- CI validation includes automated checks for build quality and security risk appropriate to the changed component.
- Dependency risk is reviewed through the documented dependency-audit process, and critical fixes are prioritized through the release workflow.
- Environment-specific secrets and service credentials are treated as sensitive configuration and are kept out of committed source files.
Data Protection Baseline
| Control | Behavior |
|---|---|
| Encryption in transit | User, API, webhook, agent, and service traffic uses TLS in transit. |
| Encryption at rest | Stored customer monitoring data, configuration data, account/profile data, audit records, session records, token metadata, and integration configuration are protected by managed encryption at rest. |
| Secrets | Service tokens, webhook signing secrets, API keys, and integration credentials are handled as sensitive secrets. Customer automation should store tokens in a protected runtime variable or secrets manager. |
| Access control | Workspace access uses role-based permissions with default Viewer, Operator, and Admin roles plus explicitly scoped service tokens. |
Identity And Access
- Workspace creators or Admins assign explicit roles to users based on the work they need to perform.
- Service tokens should use the narrowest scopes needed for automation, exports, webhooks, integrations, or monitoring configuration.
- Multi-factor authentication can be enabled for customer user accounts, and privileged internal access requires MFA.
- Local host privileges remain separate from Bitaic workspace roles for agent installation, service management, host metrics, and Windows Event Log access.
Monitoring And Incident Response
- Security-relevant audit events include authentication, role changes, session lifecycle, token administration, webhook and integration administration, exports, deletion requests, and sensitive data access.
- Operational security work follows triage, containment, remediation, customer communication when required, and post-incident review.
- Breach or incident notifications are handled according to applicable law and customer agreements.