Security at Balencia
Your personal data deserves careful protection. Explore the security practices, encryption patterns, and responsible disclosure process behind Balencia.
AES-256-GCM Field Encryption
Application-level encryption for tokens, WhatsApp credentials and private notes
HTTPS Everywhere
Every connection runs over TLS, enforced with HSTS
Responsible Disclosure
A clear channel for researchers to report security issues
Security Overview
Because you may share sensitive personal and wellness information with Balencia, we use layered safeguards across the application, its data, and the infrastructure providers we host on.
This page lists the protections in place today. Balencia does not currently claim HIPAA, SOC 2 or ISO 27001 certification, and it does not offer end-to-end encryption.
Automated Checks: Code changes run automated tests and a secret scan in continuous integration.
Infrastructure Security
Balencia runs on managed cloud providers and relies on their physical and infrastructure security:
Cloud Provider
Uses managed cloud infrastructure with provider-level physical security, access controls, and availability tooling.
Data Centers
Relies on professional data center controls provided by managed infrastructure vendors.
File Storage
Uploaded files are stored with Cloudflare, separately from the application database.
Logs & Backups
Server logs and backups are kept by our hosting providers for limited periods under their retention settings.
Encryption
Application-Level Encryption
- AES-256-GCM for connected-service tokens and sign-in identity tokens
- AES-256-GCM for WhatsApp session credentials
- AES-256-GCM for cycle-tracking notes and trusted-contact notes
- Other data relies on our hosting and storage providers' infrastructure protections
Transport & Credentials
- HTTPS (TLS) for every page, API request and real-time connection
- HTTP Strict Transport Security (HSTS) for one year, including subdomains
- Passwords stored only as hashes
- Card details entered on Stripe's checkout, not stored by Balencia
Access Control
Monitoring & Threat Detection
Security Event Logs
Sign-ins and other security events are recorded, including IP address and device information.
Audit Records
Staff actions on accounts are recorded. Audit records of the AI coach's tool use are deleted after 180 days.
Error Reporting
Crash and error reports are collected with personal fields scrubbed.
Log Retention
Security and audit logs are kept for security and compliance. Server logs are kept by our hosting providers for limited periods.
Network Security
- HTTPS enforced with HSTS on every page, API request and real-time connection
- Rate limiting on API requests, with stricter limits on authentication
- Calls use WebRTC, which encrypts call media in transit
- Google STUN servers see your IP address when a call connects
Application Security
Automated Tests
Code changes run automated test suites in continuous integration.
Secret Scanning
Changes and the full repository history are scanned for committed credentials with gitleaks.
Dependency Updates
Dependabot checks our third-party dependencies and proposes updates.
API Security
Request validation, authentication and authorization checks on API routes, plus rate limiting.
CSP & Headers
Content Security Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers.
Upload Checks
Uploaded documents pass structural file checks before they are accepted. This is not an antivirus scan.
Security Testing
Security Reviews
OngoingSecurity reviews and testing are planned around high-risk application and API surfaces.
Secret Scans
Every changeEach change is scanned for leaked credentials in continuous integration.
Dependency Checks
WeeklyDependabot reviews our dependencies and opens update requests.
Backup Restore Drill
DailyAn automated workflow backs up and restores a database built with our production schema to prove the backup pipeline works.
Incident Response
When a security issue is reported or detected, we work through these steps:
1. Detection
Alerts and reports identify suspicious activity
Detect2. Triage
Severity classification and response ownership
Assess3. Containment
Limit impact while investigation continues
Contain4. Resolution
Root cause analysis and remediation
ResolveSecurity Program
Encryption
ActiveHTTPS for every connection, and AES-256-GCM for the most sensitive fields
Access Controls
ActivePermission-based access to staff tools, with staff actions recorded
Monitoring
ActiveSecurity event logging and error reporting scrubbed of personal fields
Data Rights
SupportedIn-app export of core account data, and account deletion in the app or on the web
Vendors
ListedEvery service provider that receives personal data is named in our Privacy Policy
Payments
Provider-managedCard details are handled by Stripe and are not stored by Balencia
Responsible Disclosure
We value the security research community and welcome responsible disclosure of vulnerabilities that could affect Balencia users.
How to Report
- Email: security@balencia.ai
- Use a concise report with affected URL, steps, and impact
- Include detailed reproduction steps
- Allow 48 hours for initial response
Report Priorities
- CriticalRCE, SQL injection, auth bypass
- HighXSS, IDOR, sensitive data exposure
- MediumCSRF, information disclosure
- LowMisconfiguration, best-practice issue
Security Contact
For security-related inquiries, vulnerability reports, or compliance questions:
Security Team
General: security@balencia.ai
Vulnerabilities: security@balencia.ai
Privacy: support@balencia.app
Response Times
Vulnerability reports: 48 hours
General inquiries: 5 business days
Privacy requests: 30 days
Related Legal Pages
Found a Security Issue?
We appreciate responsible disclosure and review security reports that include clear reproduction steps and impact.