Security
Controls that make every payout deliberate
Money moves only after strong sign-in, the right role and, where it matters, a second person. Here is how Business Globalizer Bank protects your business.
Signing in
-
Passkeys and two-factor sign-in
Members can sign in with a passkey or add an authenticator app. One of them is required before anyone can add a payee or move money.
-
Password confirmation
Payouts, approvals and revealing an account number ask for the password again, so an unattended session cannot be used to move money.
-
Private sessions
Session cookies are encrypted, sent only over HTTPS and never shared with other Business Globalizer sites.
Moving money
-
Two-person approval
Every vendor payout, and own-account payouts that reach $10,000 within 24 hours, wait for a second owner or admin. Whoever requested a payout can never approve it.
-
Payee waiting period
A new payee can be paid after 24 hours for the business's own accounts and 72 hours for vendors, giving the team time to spot one that should not be there.
-
Roles
Owners, admins, finance and viewers each get only the permissions their work needs.
Protecting data
-
Account numbers not stored
A full bank account number is passed to the payments provider once. Only its last four digits are kept.
-
Encryption
Every page is served over HTTPS with HSTS. Two-factor secrets, the business contact email and payee owner names are encrypted in the database.
-
Notifications without secrets
Push notifications are encrypted for the device that receives them and never include account numbers.
Staying accurate
-
Signed status updates
Payment updates are accepted only with a valid signature, applied once, and checked again on a schedule.
-
Audit log
Payouts, approvals, payee changes and account number reveals are recorded with who did them and when.
-
Live balances
Wallet balances are read live from the payments provider, never from a stored copy that could be out of date.
Found a security issue?
Please tell us privately first. Email [email protected] with "Security report" in the subject, or use the contact form. Include the steps to reproduce it, and please do not access other people's data or disrupt the service while testing.