Platform · Security & governance
Governance built into the integration layer.
Who can see exchanges, who can change a retry policy, who wrote that SQL? Bitween answers with fine-grained roles, an audit trail written in the same transaction as every change, and hardened defaults.
61 permissions
Area-and-action permissions combined into custom roles, with Administrator, Member and Viewer built in.
Microsoft sign-in
Sign in through Microsoft Entra ID, alongside passwords or instead of them.
Strong credentials
PBKDF2-HMAC-SHA256 with 210,000 iterations, constant-time comparison, and lockout after five failures.
Immediate revocation
Permissions are read on every request, so removing a role or a partner key takes effect at once.
Secrets stay secret
Secret adapter properties are masked in every response and redacted from the audit trail.
Hardened HTTP
Content Security Policy, frame denial, no-sniff, strict referrers and no-store on JSON responses.
Audit trail
Every change, with its before and after.
Subscriptions, partners, keys, gateways, retry policies, settings, accounts and roles: each change records the member, the time and the old and new value of every property, in the same transaction as the change.
- No API edits or deletes it
- Entries from one save share a correlation id
- Filter by entity, member or date
Separation of duties
Permissions shaped around real jobs.
Operate, build, configure and administer are separate, down to writing SQL without the right to change database credentials.
| Permission | Allows |
|---|---|
exchanges.operate | Retry and resubmit exchanges, run a scheduled retry now |
subscriptions.operate | Pause, resume, receive now, roll up now, reset a retry budget |
data-source-statements.edit | Write the SQL a database may run, without changing its credentials |
data-sources.operate | Test a connection |
audit.view | Read the audit trail (there is no edit permission, because nothing can change it) |
Production checklist
Hardening, written down.
The documentation ships a production checklist. These are the first steps every deployment should take.
- 1Set unguessable break-glass admin credentials
- 2Change or replace the seeded administrator
- 3Replace or remove the SYSTEM partner’s API key
- 4Use a long random token signing key and your own issuer and audience
- 5Keep exchange files private when payloads are sensitive
- 6Serve over HTTPS and connect data sources with least-privilege logins
Documentation
Written from the source code.
Every claim on this page links to documentation that is synced from the Bitween repository.
Explore the platform
More capabilities.
Put every integration on one governed pipeline.
Talk to the architects who build Bitween about your partners, systems and message volumes, or start from the docs and run it yourself today.