Frontend — Cloud Run (Next.js)
Server-rendered marketing site + chat widget. Same-origin /api/* reverse proxy to the backend, read per request.
Trust & security
Security, trust, and how BIS is built
The answers an enterprise procurement or IT-security team needs before approving a supplier — hosting, architecture, security controls, SSO, and compliance — stated honestly, with what's in place today separated from what's on the roadmap.
BIS builds and operates a marketing site plus a closed RAG assistant that answers only from curated, public content — no customer data is ingested. This page summarizes how it is built and secured, for buyers evaluating BIS as a supplier.
BIS is a specialist, founder-led boutique. Where a control is in place, it says so; where it is a roadmap item, it says that too. Nothing here overclaims. A full vendor-security package — architecture and security diagrams, policies, incident-response and pentest procedures — is available to prospective clients on request.
GCPCloud provider
us-central1Region (United States)
REGIONALMulti-zone database HA
KeylessCI/CD (Workload Identity)
Item 1
Software architecture
The browser talks only to the frontend; the frontend proxies /api/* server-side to the backend, so the backend is never directly internet-exposed and its URL is never shipped in the browser bundle.
Backend — Cloud Run (FastAPI)
RAG chat (SSE streaming), admin API (JWT-protected), lead capture, and a public read-only MCP endpoint.
Data — Cloud SQL + pgvector
PostgreSQL 15 with vector search, reached only via the Cloud SQL connector (TLS + IAM). REGIONAL high availability.
AI — Vertex AI
Managed LLM chat and text embeddings. The assistant refuses when nothing relevant is retrieved — no ungrounded answers.
Item 2
Security architecture — defense in depth
Protection is layered from the edge to the data. No single control is a sole line of defense.
Edge
External HTTPS load balancer with managed TLS and a Cloud Armor WAF — OWASP rules (SQLi, XSS) plus per-IP rate-based banning.
Application
Security headers + CSP, bcrypt + short-lived JWT admin auth, per-IP rate limits with a daily cap, input validation and path-traversal guards, sanitized errors with a correlation id.
Data & secrets
No authorized public networks on the database; secrets in Secret Manager injected at runtime; client IPs truncated before any logging.
Platform & supply chain
Least-privilege IAM, non-root containers, and keyless CI/CD (Workload Identity Federation) with secret, SAST, image, and dependency scanning.
Items 3 & 6
SSO and single sign-on
By default the admin panel uses a single-administrator password flow that issues a short-lived JWT, with rate-limited login. Federated SSO is supported two ways, one already built.
Available (not active by default): a code-level OIDC single-sign-on exchange — the admin surface can validate an identity provider's signed OIDC token (signature, issuer, audience, expiry) against a configured allow-list and issue its session, selected by a validated configuration switch. Planned: Google Cloud Identity-Aware Proxy (IAP) in front of the admin path on the existing load balancer, performing SSO at the edge with no bespoke authentication code. For client engagements, SSO means integrating the delivered software with the client's own identity provider (OIDC or SAML) as part of project scope.
Item 4
SOC-style documentation & testing
BIS maintains, at a level appropriate to a boutique, a documented security program shared with prospective clients on request.
Policies & procedures
Information-security policy, standard operating procedures (access, secrets, deployment, backup/restore), and an incident-response procedure with severity levels and response-time targets.
Records & logs
Structured logs with per-request correlation ids to Cloud Logging; admin actions and auth failures recorded; personal data minimized.
Continuous testing
Every change runs secret scanning (gitleaks), SAST (CodeQL), image scanning (Trivy, blocking on critical), and a blocking dependency audit (pip-audit).
Penetration testing
Rules of engagement and an annual external-pentest cadence are documented; the first external test is a scheduled roadmap commitment.
Item 5
Hosting, data residency & backups
Provider & region
Google Cloud Platform, region us-central1 (Iowa, United States). All production compute, storage, and AI inference run in the US.
Data handling
The RAG corpus is curated public content only. Visitor data is limited to chat questions (with truncated IPs) and voluntarily submitted leads.
Backups & recovery
Automated daily backups + point-in-time recovery (14-day window) and REGIONAL multi-zone failover.
Subprocessors
Google Cloud (hosting, database, Vertex AI), Google Analytics (web analytics), and — only if configured — an SMTP provider for lead notifications.
Items 7–9
Vendor size, global reach & compliance
BIS is a specialist, founder-led boutique — engagements are led personally by Renan Butkeraites, PhD in Operations Research. This is a deliberate positioning; buyers who require a large-headcount vendor should weigh it.
Production runs single-region in the United States. For clients who need another region, data residency, or an already-certified environment, BIS deploys the solution into the client's own cloud and stack, inheriting their compliance boundary. BIS-hosted multi-region is a roadmap item.
BIS holds no SOC 2, ISO 27001, or equivalent certification today. A control mapping and an honest certification roadmap are maintained and shared on request; BIS answers vendor questionnaires directly in the meantime.
Evaluating BIS as a supplier?
Request the full vendor-security package — architecture and security diagrams, policies, incident-response and penetration-testing procedures, and a point-by-point questionnaire response. We answer procurement questions directly and honestly.