Row-level tenant isolation
Every organization's data lives behind row-level security policies enforced by the database itself, not application code. A bug in a page can't leak a record the database refuses to return.
Security
Built to protect
every business
running on it.
Every organization's data is kept apart at the database level, every action is checked against what your role is allowed to do, and card payments never touch our servers.
Six things that
are always true.
No slogans — just the protections that are switched on for every account, on every plan.
Encrypted in transit
Every connection uses TLS. Nothing about your business moves across the internet in plain text.
Role-based access control
Every teammate gets exactly the access their role needs, down to individual modules and actions — not an all-or-nothing account.
Multi-factor authentication
Protect every login with a second factor — authenticator app or SMS.
Audit trail
Sensitive actions are logged — who did what, and when — so support and admin activity is never a black box.
Independent testing
An outside security firm tests the application on a recurring schedule, and every finding gets fixed before it ships to customers.
Always on
Guarded around
the clock.
Protection isn't a setting you have to remember to switch on. It runs on every page, every login and every record, all the time.
One request, start to finish
What happens between
your tap and our reply.
1
Your request travels over TLS
The connection between your device and Octabiz is encrypted before a single byte of your business data moves.
2
We check who you are
Your session is verified. An expired or unknown session never gets past this point.
3
We check what you're allowed to do
Your role decides which modules and actions are open to you, and row-level policies decide which records the database will even return.
4
You get back only your own data
The answer arrives already scoped to your organization and your permissions — filtering doesn't depend on the page remembering to ask nicely.
What runs underneath.
Boring on purpose. These are the habits behind the product, not features you have to configure.
Independent pen-testing
An outside firm tests us every quarter
24/7 on-call rotation
Someone is always reachable if something looks wrong
PCI DSS SAQ-A
Payments run through Stripe. Octabiz never stores card numbers, which puts us in the lightest PCI category there is.
Enterprise customer?
We'll walk your security team through our architecture and answer your questionnaire directly — book a call below.
We only list what we've actually completed. When further certifications are finished, they'll appear here.
Questions we'd ask
any vendor.
Where is my data stored?
Your data lives in a managed, access-controlled cloud database run by our hosting provider, with encrypted connections and regular backups. If your organization needs the data held in a specific country or region, talk to us — we'll confirm exactly what's possible for your setup before you sign anything.
Who can access it inside Octabiz?
Internal access is role-based: our team members only get the access their job needs, and support staff work from the same permission system the product uses. If we ever need to look at your account to solve a problem, we'll tell you what we looked at and why.
What happens during an incident?
We identify the problem, contain it, tell the customers who are affected, and then fix the cause. We won't promise a contractual notification window we haven't written into your agreement — if your business needs one in writing, ask us and we'll put it in your contract.
How are payments protected?
Card payments are handled by Stripe. Card numbers go straight to them and never land on Octabiz servers, which is why we fall under PCI DSS SAQ-A — the lightest category, for businesses that never touch card data.
Bring your
toughest questions.
Our team will walk you through how Octabiz is built, what we do and don't claim, and answer whatever your security reviewer needs to know.