Trust
Security & data protection.
Last updated October 13, 2026. Your business context deserves clear boundaries. Here is how Bussco protects access, preserves decision history and handles payments, along with the limits of those safeguards.
Your business has its own boundaries
Workspace records are scoped to an organization. Membership and permission checks govern what a signed-in person can read or change, both in the application and through database access rules. Belonging to one business does not grant access to another.
Defined team roles
Owners and Strategic/Admins manage the business. Contributors can contribute within their permitted scope. Viewers are read-only except for assigned questions, assigned client actions, help requests and explicitly designated deliverable approvals.
Support and consulting are distinct
Authorized Bussco administrators can access information for platform support. Consulting delivery authority requires an engagement assignment; platform administration alone does not authorize delivery or changes to accepted business knowledge.
Protecting your account and seeing who did what
Every person signs in with their own email and password. You can add two-step sign-in with an authenticator app, sign out every other device from Settings, and Owners and Admins can review a security and activity history showing who joined, who was given access, who used which tool and any work done by the Bussco team.
Consultant access needs your approval
A Bussco consultant assigned to your business can't see your Business Brain until an Owner or Admin approves it. You can set an end date or revoke access at any time, and each change is recorded.
Your research choice is yours
Contributing to anonymized industry research is off unless an Owner or Admin chooses to join. It can be changed anytime in Settings → Data, and each change is recorded. The choice is also offered, unchecked, during onboarding.
Browser protections
Pages ask browsers to always use a secure connection and to block other websites from embedding Bussco to trick people into clicking. Alex and setup answers warn you if something looks like a password, access key or card number.
ALEX assists. People decide.
ALEX and the strategic tools use large language models on relevant Workspace context to analyze your data at scale and produce proposals and synthesis. A generated proposal does not automatically become accepted Business Brain knowledge. People review, edit and explicitly accept what belongs in their business.
What ALEX can see
ALEX answers only from your business's own records: accepted Business Brain information, your intake answers, active tasks and work items, and documents you chose to share. It does not browse the open web, and it never sees another business or files you kept private.
Documents are private by default
Files in Documents & assets stay out of ALEX's reach unless an Owner, Admin or Contributor turns on "Let Alex read this" for that file. You can turn it off at any time. Scanned files with no readable text are labeled honestly.
Traceable work
Saved work includes source and attribution records. Edited tool results retain their generated original, while accepted active versions can inform subsequent work. Delivered assets are content-locked rather than silently rewritten.
External processing
Requests pass through our secure cloud gateway to large language model providers whose infrastructure complies with SOC 2 Type II, ISO 27001 and GDPR standards. Do not enter passwords, payment credentials or unnecessary sensitive personal information. Our privacy policy explains this processing; we do not make a blanket zero-retention or no-training promise.
Payments stay with Paddle
Paddle.com acts as Merchant of Record for subscriptions and handles payment details directly. Bussco does not store your full card number. Billing management requires an authenticated Workspace Owner. Payment notifications are checked against their signing secret before updating subscription records and access; repeated notifications are handled without duplicate fulfillment.
Data controls, with clear limits
Data & trash supports deleting and restoring eligible items, with a 30-day restoration window for soft-deleted records. Resetting data is permission-controlled and is not an erasure of protected delivered originals or legally required billing records. Business deletion is blocked while subscribed. Contact hello@bussco.com for account deletion or a broader data request.
Exports
Owners and team members can download everyday work, such as the one-pager, briefings, reviews and campaign narratives, at any time. A complete Business Brain export is prepared by the Bussco team as a Business Strategy Dossier on request, so a full archive is sent only to an authorized person.
Public demo
Demo drafts and illustrative results stay in browser storage and are not live Workspace records. Reset clears the demo draft; it does not delete your account. Public-page analytics may still measure demo interactions.
Public-site measurement
Microsoft Clarity provides public-site interaction analytics, heatmaps and session replay. Workspace and onboarding paths are excluded from directly loading its script. This is not a guarantee that every signed-in interaction is untracked. See our privacy policy for details.
Report a security concern
Email hello@bussco.com with the affected page, a description and safe reproduction steps. Do not include passwords, access tokens, card details or another customer's information. Do not access other businesses, disrupt the service or conduct destructive testing. We will review your report and coordinate appropriate next steps; this is not a paid bug-bounty program. Our disclosure contact is also published at /.well-known/security.txt.
How the platform is protected
Behind the scenes, the Workspace is built on well-established protections. We describe them in plain language here; we deliberately keep the fine technical details private, since those are the parts an attacker would look for.
Traffic filtering at the edge
All visits to Bussco pass through a global network that absorbs and blocks large-scale attacks aimed at overwhelming the service, before they ever reach our servers or database.
Protected database queries
The application never builds database queries from raw text you type. Every lookup uses safe, parameterized queries, which shuts down a whole class of attacks that try to trick a database into revealing information.
Strict separation between businesses
Every record in the database carries the identity of the business it belongs to, and the database itself enforces that boundary on every read and write — not just the app on top of it. One business simply cannot read another's data.
Protection against malicious code in pages
Content you enter is treated as text, never as instructions the browser should run. This prevents someone from planting harmful code that would run in another person's browser.
Isolated, short-lived computing
Work on the server runs in isolated environments that are created for the task and discarded afterward. There is no long-lived shared machine where leftover data could linger.
Encrypted connections and storage
All connections are encrypted in transit, and sensitive values such as connected-account credentials are stored encrypted. Files live in private storage and are only reachable through short-lived, signed links.
Have a security or privacy question?
Tell us what your business needs to understand before using the Workspace.