Security Overview
Last updated April 18, 2026
This page describes how we protect clepit, prodantix and the Bomdisoft ID, accounts and billing services they run on, and how to report a security problem to us.
Your data in transit
Every site and API we run is served only over HTTPS; a plain HTTP request is redirected to HTTPS.
Signing in
Every person can protect their Bomdisoft ID with passkeys, security keys or an authenticator app. Failed sign-in attempts are limited for each account and each network address, an account is locked after 100 consecutive failures, and an unknown email address is answered the same way as a known one. Clepit organisations can sign their members in through their own identity provider, with OIDC or SAML, and provision them with SCIM.
Keeping each organisation’s data separate
Each organisation’s data is separated at the database, which enforces the separation with row-level security. A clepit Enterprise organisation can have a database of its own.
AI features
We never use your data to train AI models, ours or anyone’s. AI writing features stay off until your organisation turns them on.
Keeping software up to date
We receive automated alerts and proposed updates for known vulnerabilities in the software we depend on.
If something goes wrong
If we confirm a breach affecting your organisation’s data, we tell your organisation’s owners and admins by email without undue delay, and at the latest 72 hours after we confirm it.
Deleting your data
When you ask us to delete your account, we delete it within 30 days.
Who processes your data
The companies that process customer data for us, what they do and where, are listed on our subprocessors page.
Reporting a vulnerability
Email security@bomdisoft.com. Please write in English, and include:
- the product and the address of the page or API affected;
- the steps to reproduce the problem;
- what an attacker could achieve with it;
- how we can reach you.
What we commit to
- We acknowledge your report within two business days.
- We keep you informed while we investigate and fix it.
- We tell you when the fix is live, and credit you publicly if you want us to.
What is in scope
bomdisoft.com, clepit.com, prodantix.com, and the apps and APIs under those domains.
Rules for testing
- Test only with accounts you own or have permission to use.
- If you reach data that is not yours, stop, do not keep or share it, and tell us.
- Do not degrade our services: no denial of service, no high-volume automated scanning.
- No social engineering of our team or customers, no spam, no physical attempts.
- Give us reasonable time to fix a problem before you disclose it; we agree a date with you.
We do not pay bounties.
Out of scope
- Services run by other companies, including those on our subprocessors page; report those to the company concerned.
- Findings with no security impact, such as missing headers on pages that hold no personal data, or messages that confirm a product exists.