Current as of 13 July 2026
Bily operates a security program designed to protect customer data throughout the service lifecycle. Our controls cover identity and access, request validation, tenant isolation, consent enforcement, data minimisation, monitoring, and data lifecycle management.
This overview describes the controls currently applied to the Bily service. Contract-specific commitments are set out in the applicable order form or signed data processing addendum.
Security principles
Scope every request. Protected product workflows are designed to evaluate user, organisation, property, and permission context rather than treating a URL or client request as authority.
Verify sensitive traffic. Supported signed webhooks and partner callbacks are cryptographically verified before trusted processing.
Minimise exposure. Bily treats credentials and customer identifiers as restricted operational data and limits their use to the workflows that require them.
Respect consent signals. Where the connected platform exposes a required consent state, protected identity or marketing activation waits for that state and future delivery stops when consent is revoked.
Remove access with the resource. Removing a connected property invalidates relevant cached access and deletes supported application and tenant resources associated with that property.
Identity, access, and tenant boundaries
Bily’s access model ties protected product workflows to authenticated users and evaluates organisation, property, and permission scope before returning protected data or performing privileged actions. Customers should apply least privilege, review team and account permissions, and remove users who no longer require access.
Browser authentication uses security-focused cookie and session settings where applicable. Credentialed requests are limited to trusted origins, and exposed endpoints use rate limits or other abuse controls in proportion to their purpose. These measures reduce risk but do not replace strong customer passwords, secure devices, and careful permission management.
Transport and request protection
Bily’s public website and product endpoints are delivered over HTTPS. We use request validation, origin checks, permission checks, and cryptographic signature verification where a provider supports signed delivery. We do not publish blanket claims such as bank-grade security, universal AES-256 encryption at rest, or a specific algorithm across every store because those claims are broader than the evidence currently supports.
Integrations and connected platforms
Connected services are authorised by the customer and limited to the permissions required for the requested feature. Signed partner webhooks are verified before processing where the integration supports signatures. Tokens and credentials are treated as restricted operational data and are intended only for the connected workflows that require them. Customers remain responsible for the security and permissions of each connected account.
Consent, identity, and data minimisation
Where a commerce platform provides a consent signal used by a Bily integration, identity or marketing tracking that requires consent is activated only after the necessary state is present. Revocation stops future protected event delivery and clears relevant protected identity caches in the supported flow. Customer configuration, jurisdiction, and the connected platform still determine which consent rules apply.
Operational logs and audit paths are designed to avoid unnecessary secrets and to minimise metadata. Bily may process customer, order, visitor, and advertising data when the customer directs the Service to do so, but customers should send only data that is necessary and lawful for their use case.
Retention and deletion
Different data stores serve different purposes and have different lifecycles. Some operational event stores are configured around 90 days; transient caches and delivery tokens can be much shorter; account, billing, derived, support, security, and legally required records can be longer. We do not describe 90 days as a universal retention period.
Store owners can remove connected properties through supported product workflows. Removal deletes associated application records and tenant resources and invalidates relevant caches. Some records may remain temporarily where required for billing, security, legal claims, fraud prevention, immutable logs, or backup cycles. Connected third parties control their own copies.
Payments
Payment and subscription processing is handled by specialist billing providers or the relevant commerce platform. Bily does not use a public claim of PCI certification for itself. Customers should review the payment provider’s terms and security information for the payment flow they use.
Operational security and incidents
Bily uses logging, monitoring, testing, access restrictions, and change controls appropriate to the service and the risk of a change. When a suspected incident is reported or detected, the response is to validate the signal, limit exposure, preserve useful evidence, restore safe operation, determine affected scope, and communicate when required by applicable law or contract. This page does not promise 24/7 staffing, a fixed response time, or a guaranteed notification deadline.
Service providers
Bily relies on specialised providers for infrastructure, data processing, billing, communications, monitoring, support, and AI inference when an AI feature is invoked. We assess providers in proportion to their role and use contractual and access controls appropriate to the data involved. See Subprocessors for the public provider categories and the contract-review path.
Customer responsibilities
Protect account credentials, devices, and recovery channels; use unique passwords and available multi-factor authentication where offered.
Give users only the permissions they need and promptly remove former staff and agencies.
Connect only properties and destinations you are authorised to control.
Configure consent, notices, data minimisation, retention, and destination settings for your jurisdiction and business.
Review AI-assisted output and do not place secrets or prohibited sensitive data into prompts.
Keep independent copies required for business continuity and report suspected compromise promptly.
Assurance and evidence
Bily’s assurance program is organised around documented controls, operational evidence, and customer security review. Independent attestations and certifications are published here only when they are current and apply to the relevant service scope. The controls and contractual commitments described on this page are the authoritative source for Bily’s present security posture.
Reporting a vulnerability or incident
Email [email protected] with the subject SECURITY and include a clear description, affected URL or account scope, reproduction steps, impact, and a safe contact method. Do not access data that is not yours, disrupt production, use social engineering, exfiltrate data, or publish a vulnerability before we have had a reasonable opportunity to investigate. We do not promise a reward, but we value careful, good-faith reporting.
For privacy questions use [email protected]. For contractual security review use [email protected].