Security
This page is maintained by Behera to answer common security and privacy questions about the Behera platform. It reflects controls we currently operate; it is not an independent certification.
Access control
Every workspace is isolated by tenant. Row-level security policies enforce that agents only see their own records within their brokerage, while brokers and admins see everything in their brokerage. Cross-brokerage access is not possible through the application.
Authentication
Sign-in is available with email/password and Google. Passwords are hashed by our identity provider; sessions use short-lived tokens with automatic refresh.
Data in transit and at rest
All traffic to Behera is served over HTTPS. Data is stored on managed infrastructure with encryption at rest provided by our hosting platform.
Secrets and third-party keys
API keys for third-party services (AI, e-sign, email, payments) are stored as server-side secrets and never exposed to browsers.
Public forms and tokens
Client-facing form links use unguessable, expiring tokens routed through server functions with rate limiting. Underlying tables are never directly exposed to unauthenticated users.
Reporting a vulnerability
Please email security@behera.com with details. We aim to acknowledge reports within two business days.