Security & data protection

1. Every company kept apart

BMS Prime is a multi-company service. Every record belongs to one company workspace, and the server checks that ownership on every request, so one company can never read or change another company’s data, even by guessing an address or an ID. A person who works for several companies switches between them explicitly, and sees each company’s data only with the access granted in that company.

2. Role-based access and permissions

• Two levels of control. Each company chooses which modules it uses, and each person is given specific permissions inside them, such as viewing payroll but not issuing it, or entering bills but not approving them.
• Checked on the server. Hiding a button is never the only protection. Every request is checked on the server against the person’s permissions and the company’s modules before anything is read or changed.
• Least privilege. Give each person only the modules and actions their job needs. Employees using self-service see only their own payslips, leave, attendance and documents.
• Instant blocking. An administrator can block a user at once. A blocked user cannot sign in, and any session they had open stops working.
• Separation of duties. Finance approvals, period closing and payroll issuing can be limited to different people, and closed accounting periods are locked against changes.

3. Secure sign-in

• Password rules: at least 8 characters, including a letter and a number. Passwords are stored only as salted hashes; nobody at BMS Prime can read them.
• Brute-force protection: after 5 failed attempts, an account is locked for 15 minutes, and sign-in requests are rate-limited.
• Two-step sign-in: a one-time code, sent by email or generated by an authenticator app where enabled, on top of the password. Sign-ins from a new browser can be required to confirm a code before they get in.
• Idle sessions end: a browser session left idle for 24 hours is signed out automatically.
• Verified sign-ups: new businesses confirm their email address with a code and give their business details, and we verify every business before it can buy a plan.

4. Encryption

All traffic between your browser or app and BMS Prime is encrypted with HTTPS (TLS). Session cookies are marked secure and HttpOnly. Secrets for connected services, such as the key of an attendance device or a mail server password, are stored encrypted with a key held outside the database.

5. Audit trail and records that do not change behind your back

• An audit log records who created, changed, approved or deleted records, and when.
• Issued payslips are locked for good. A correction is made in a later payslip, so pay history never changes silently.
• Posted accounting entries are corrected by reversing entries, not by editing history, and closed periods are locked.

6. Backups and recovery

• Automatic backups of the database and uploaded files are taken on a schedule and kept for a rolling period.
• We test backups by restoring them, because a backup is only useful if it really restores.
• Company administrators can download a full backup of their own data at any time, and can send backups to their own Google Drive if they connect it.

7. Monitoring and data integrity

Automated agents run in the background around the clock. A books health check runs every morning to confirm that every company’s ledger balances and that its subledgers agree with it. Bank balances are reconciled against the ledger every night. Any difference raises an alert, so problems are found early, not at month end. We also monitor errors and unusual activity on the platform.

8. How we build and change the Service

• Changes are reviewed and tested before release, including automated tests of permissions and of the payroll and accounting calculations.
• Code and configuration are kept in a private repository. Production secrets are never stored in code.
• Access to production systems is limited to the few people who need it to run the Service.

9. Infrastructure and providers

BMS Prime runs on the infrastructure of an established hosting provider, which operates the physical security of its data centres. The providers we use and what each one receives are listed in our Privacy Policy.

10. Incidents

If we become aware of a breach affecting personal data in your workspace, we notify your administrators without undue delay and within 72 hours, with what we know and what we are doing about it, as set out in the Data Processing Addendum.

11. Your part

Security is shared. Please use strong, unique passwords, turn on two-step sign-in for administrators, give each person only the access they need, remove access when someone leaves, and keep your devices up to date.

12. Reporting a vulnerability

If you believe you have found a security weakness in BMS Prime, please email info@bmsprime.com with the details and give us reasonable time to fix it before telling anyone else. Do not access other customers’ data, disrupt the Service or run automated scans; testing without our written permission is not allowed under our Acceptable Use Policy. We appreciate responsible reports and reply to every one.

Last updated: 22 October 2026.