Hosting and data location
- The Birch app, its API and its PostgreSQL databases run on Railway in the US West region (us-west2). Data for Indian and US organizations is stored there.
- Uploaded documents are stored in Google Cloud Storage.
- This website runs on Vercel.
Encryption
- All traffic to Birch is served over HTTPS. The API sends HSTS headers in production, so browsers refuse plain HTTP.
- Documents are encrypted at rest by Google Cloud Storage. The bucket is private: files open only through time-limited signed links, never a public address.
Sign-in
- Birch uses one-time codes sent by email instead of passwords. Codes are 6 digits and expire after 10 minutes.
- Sessions last up to 7 days.
- Sign-in endpoints are rate limited.
Access control
- Requests for HR data are scoped to the signed-in user's organization.
- Access within an organization follows five roles: Owner, HR Admin, HR Staff, Manager and Employee.
- Changes made through the HR API are recorded in an audit log.
Certifications and audits
Birch does not hold any security certification yet. We will update this table when that changes, and we will not show a badge before we have the report.
- SOC 2Not started
- ISO 27001Not started
- Independent penetration testNot done yet
Report a vulnerability
Email team@birchspace.co with "Security" in the subject. Please give us a reasonable time to fix the issue before you disclose it. We do not run a paid bug bounty.
Need a security questionnaire answered or a data processing agreement? Contact us.