Trust & security
Trust built on transparency, not promises.
Bitween is open source, runs in your own infrastructure and is documented from its source code. Here is how your data is kept, what the product does to protect it, and what you're responsible for.
Data residency
Your data never leaves your environment.
Runs in your environment
Bitween is a container you deploy in your own cloud account or data centre.
Records stay in your database
Configuration, exchanges, results and the audit trail live in your PostgreSQL, SQL Server or MySQL.
Payloads stay in your storage
Exchange files are written to your S3, Azure Blob or Oracle Cloud bucket, with retention you choose.
No vendor service in the path
When you self-host, no Simplify9-operated service receives, processes or stores your messages.
In the product
Security controls that ship with every instance.
These are described in detail in the security documentation, which is synced from the source repository.
Role-based access
61 permissions across operate, subscriptions, configuration and administration, read from the database on every request.
Sign-in
Email and password with lockout after five failures, Microsoft Entra ID sign-in, and inactivity sign-out.
Password storage
PBKDF2-HMAC-SHA256 with 210,000 iterations, a random salt and constant-time comparison.
Audit trail
Every configuration change with old and new values, written in the same transaction, with secrets redacted.
Secret handling
Secret adapter properties masked in every response; the license key encrypted with AES-256-GCM.
HTTP hardening
Content Security Policy, frame denial, no-sniff, strict referrer policy, closed CORS by default and 50 MB body limits.
How it's built
Engineering practices you can verify.
Open source
The full source is public under the MIT License. Review it, build the image yourself, pin the version you trust.
Docs written from the code
The documentation is written from the source and re-checked against it.
Dependency hygiene
Dependabot watches dependencies, and a gate fails pull requests to release branches while critical alerts are open.
Automated tests
Unit and integration test suites run in the release pipeline before images, charts and packages are published.
Shared responsibility
Self-hosted means clear lines.
Because Bitween runs in your environment, it sits inside your existing controls and certifications. Security documentation for procurement reviews is available on request.
| Area | Bitween | You |
|---|---|---|
| Application security controls, roles and audit trail | ||
| Documentation and a production checklist | ||
| Security fixes in new releases | ||
| Infrastructure, network and TLS | ||
| Database and storage encryption, backups and retention | ||
| Secrets management and credential rotation | ||
| Access reviews, upgrades and regulatory compliance |
Responsible disclosure
Found a vulnerability? Tell us privately.
Email a description, the affected version and steps to reproduce to [email protected] with “Security disclosure” in the subject. Please don't open a public issue for security problems. We'll acknowledge your report and keep you informed while we work on a fix.
Preparing a security review?
Talk to the engineers who build Bitween about architecture, hardening and how it fits your controls.