Security at Superlock

We hold keys to your weak spots. Here's how we guard them.

Superlock sees what's wrong with a business before it's fixed, so it has to be harder to break into than the businesses it protects. This page says exactly what we do, in plain words.

Read-only by design

• Superlock only reads. Microsoft 365 and Google Workspace grant read-only permissions that Superlock requests. For GitHub, Shopify and Stripe you create the token or key yourself; the setup steps ask for read-only permissions only, and Superlock never sends a write request with them.
• Stripe accepts only restricted keys. Full-access sk_ keys are refused. Give the restricted key read permissions only (the setup steps list them) and it can't move money, even if our database were stolen.
• The only thing Superlock ever changes is a DNS record you approve, through a DNS connection you create (a Cloudflare token limited to the zones you choose, or keys for Route 53, DigitalOcean or Porkbun), or on your DNS host's own approval screen through Domain Connect. Every change is shown first, logged and verified afterwards. If a change fails halfway, Superlock puts back what it already changed, and you can undo an applied fix.
• Microsoft 365: we store only your tenant ID, no Microsoft tokens. A tenant can only be connected by a business that has proved it owns one of that tenant's domains. Remove the Superlock app in Entra and access ends.

Secrets and passwords

• Tokens, keys and webhook addresses are stored encrypted in BizMax's credential store, never sent back to the browser, and deleted when you disconnect or delete your account.
• Passwords are hashed with scrypt. Session tokens, password-reset links, invitations, recovery codes and report-share links are stored only as SHA-256 hashes.
• Authenticator-app 2-step login with single-use recovery codes. Owners can require it for the whole team, and until someone sets it up they can't see anything in the account. Codes can't be replayed, each sign-in allows five tries, and you're emailed when 2-step login is turned on.
• Password sign-ins are rate-limited per address and per network, reset requests per address and per network, and 2-step codes per account. New domains, businesses and invitations are capped per day.

Isolation and the web app

• Every query is scoped to your business; one business can't read another's data.
• Roles and permissions. Each person has a role, ready-made (Owner, Admin, IT provider, Member, Bookkeeper, Viewer, Auditor) or custom, built from 19 permissions. Every request is checked twice on the server: once when it arrives and again by the action itself. Nobody can grant a permission they don't hold, only owners can make owners, the last owner can't be removed, nobody can change their own role, and only an owner can delete the business.
• Session cookies are HttpOnly, Secure and SameSite. Every change needs a JSON request from the Superlock page itself, which blocks cross-site request forgery.
• Everything we show from the outside world (DNS records, page headers, app names) is rendered as text, never as HTML.
• Our scanner and uptime checks only connect to public internet addresses on ports 80 and 443, pinned to the address we checked. Alert webhooks only go to Slack, Teams, Discord, Google Chat, Zapier and Make, and never follow redirects.

A log you can verify

Checks, changes, connections, decisions, alert settings and sign-in settings are written to a per-business log where each entry includes the SHA-256 hash of the one before it. Editing or deleting an entry breaks the chain. You can re-verify the whole chain in your browser, or download it and verify it yourself. The format is published as superlock-log/1.

Scanning other people's domains

The free scan reads only public records: DNS, the public registration record, certificate logs and a few ordinary page requests. It doesn't log in, guess passwords, scan ports or test exploits. Deeper checks (exposed files, plugin versions, breach lookups) run only on domains whose owner has proved control with a DNS record.

Your data, your call

• Download everything as JSON from Settings → Your data. Secrets are never included.
• Deleting your business removes its users, domains, connections and stored tokens, results, history and log immediately.
• See the privacy page for what we collect and who processes it.

Report a vulnerability

If you've found a security problem in Superlock, email security@bizmax.io. Please give us a reasonable time to fix it before telling anyone else, and don't access other customers' data or disrupt the service while testing. We won't take legal action against good-faith research that follows these rules.

Superlock is a BizMax venture, in beta. Last updated 24 October 2026.