Security
We're not SOC 2 certified — and we won't pretend otherwise. Appcovi is a small team, and a formal SOC 2 audit costs more than we can justify at our current size. What we have done is build Broiler Base Mate from day one following the same five SOC 2 Trust Services Criteria — Security, Availability, Confidentiality, Processing Integrity and Privacy — that a real audit would check. As we grow, pursuing formal SOC 2 Type II certification is on our roadmap.
Appcovi
432 Wheat Road, Beaufort SA 5550, Australia
Security contact: appcovi2026@gmail.com · Phone: 0428 337 887
Built following SOC 2's five Trust Services Criteria
HTTPS/TLS everywhere, Google-account login (no passwords stored), httpOnly + secure session cookies, rate limiting on sensitive endpoints, and an internal audit trail of admin actions.
Automated nightly encrypted backups with retention, daily health monitoring, and automatic error alerting so issues get caught early — usually before you'd notice.
Strict per-farm data isolation enforced on every request — your account can only ever see your own farm's readings, weights, mortality and reports.
Server-side validation on data entry, global error logging so failures are caught and fixed rather than silently corrupting records.
We only collect what's needed to run your account (email, name, farm name, subscription tier). Your farm's operational data — silo readings, weights, mortalities, batch numbers, EOB reports — is yours, not ours. We never sell, share or rent it, and never use it to train third-party AI models. See our full Privacy Policy.
Concretely, what we do
- No stored passwords: sign-in uses Google OAuth (Emergent-managed) — there's no password database to ever be breached.
- Encryption in transit: every connection to Broiler Base Mate is HTTPS/TLS.
- Encryption at rest: your data is stored on MongoDB Atlas, which encrypts data at rest by default.
- Session security: session cookies are httpOnly (invisible to page scripts) and secure (HTTPS-only), with a 30-day expiry.
- Access control: role-based access (owner, invited operator, staff QR-link) — staff links are scoped to a single farm and a single function (e.g. logging mortality), never full account access.
- Rate limiting: sensitive endpoints (login, error reporting, outreach) are rate-limited to blunt automated abuse.
- Audit trail: admin-level actions (like creating or deleting a farm) are logged with who, what and when.
- Automated backups: a full encrypted backup runs every night, with a rolling retention window, and we get notified if a backup ever fails.
- Error monitoring: unexpected errors anywhere in the app are logged and flagged automatically, so problems get fixed fast.
- Security headers: HSTS, X-Frame-Options, X-Content-Type-Options and a restrictive Permissions-Policy are set on every response.
Sub-processors
We use a short, deliberate list of providers to run the Service — never more than we need:
- Stripe — subscription billing (PCI-DSS compliant; we never see full card numbers).
- MongoDB Atlas — encrypted database hosting.
- Resend — transactional emails only (welcome emails, EOB reports you request).
- Google Gemini via Emergent Integrations — optional AI docket/scale/mort-sheet scanning; images are processed on-demand and not retained by the provider.
Reporting a security issue
Found a vulnerability? We'd genuinely rather hear about it from you first. Email appcovi2026@gmail.com with details — we'll acknowledge within 2 business days and keep you posted as we fix it. Please don't test against other customers' farm data.