Security & Architecture

Built for the people who take security seriously

You manage other companies' infrastructure and credentials — so you hold us to the same bar you hold yourselves. Here is exactly how Blackhawk MSP protects data in transit, at rest, and in use, with the controls and algorithms spelled out.

TLS 1.2+ everywhere AES-256-GCM at rest bcrypt password hashing TOTP + Duo MFA PCI SAQ-A payment scope

Security architecture at a glance

The control, and how it's actually implemented — no hand-waving.

Transport encryption

TLS 1.2+ enforced on all connections (HTTPS). No plaintext transport.

Data at rest

Sensitive fields (stored credentials) encrypted with authenticated AES-256-GCM — confidentiality and tamper detection on every record.

Password storage

One-way bcrypt (adaptive work factor). No reversible passwords; no plaintext, anywhere.

Multi-factor auth

TOTP (RFC 6238, 6-digit / 30s) and Duo push. Enforceable per account.

Brute-force defense

Failed-login throttling and account lockout, with alerting on repeated failures.

Session security

Session IDs rotated on login and privilege change; idle timeout; step-up re-authentication for sensitive actions.

SQL injection

Parameterized queries / prepared statements (PDO) throughout. No string-built SQL on user input.

Cross-site scripting

Contextual output encoding, plus allow-list HTML sanitization of any rich text before it's rendered.

CSRF

Per-session anti-CSRF tokens on state-changing requests, verified in constant time (hash_equals).

Card data

Never stored or processed on our servers. Handled directly by PCI-DSS Level 1 providers (Stripe) — tokenized, with 3-D Secure / SCA.

Payment webhooks

Verified with HMAC-SHA256 signatures before any action is taken; idempotency keys prevent duplicate charges.

File uploads

Content-screened on upload, stored outside the web root, and delivered only through authenticated, access-checked handlers (no direct/traversal access).

Access control

Role-based (admin / staff / client), least-privilege by default, with per-object ownership checks.

Audit trail

Authentication events and access to protected data are logged with user, action, and timestamp.

Tenancy

Single-tenant deployment — your instance and database are isolated, not pooled with other customers.

Secrets & internals

Config, keys, and application internals are stored outside the web-served path and return 403 to the public web.

The credential vault, in detail

Storing your clients' credentials is the highest-trust thing this platform does, so it gets the strongest controls. Secrets are encrypted with authenticated AES-256-GCM — the authentication tag means a tampered ciphertext is rejected, not silently decrypted. The vault fails closed: if a valid encryption key isn't present, it refuses to store or reveal secrets rather than falling back to anything weaker.

Access is gated behind role-based permissions and step-up re-authentication (password or TOTP) with a short, time-boxed unlock window. Every reveal is written to an immutable-style audit log — who, what, and when — so there is always an accountable record of credential access.

Payments & your PCI scope

Designed so card data never enters our environment — keeping your PCI footprint small.

Card data is out of scope

Card details are captured directly by the payment processor's hosted fields and never transit or land on our servers, supporting an SAQ-A posture for card-not-present payments.

Tokenization & SCA

Payments use tokenized methods and support 3-D Secure / Strong Customer Authentication. Saved-card autopay charges run off-session through the processor — we hold tokens, never PANs.

Verified, idempotent processing

Inbound payment webhooks are rejected unless their HMAC-SHA256 signature validates, and every charge carries an idempotency key so a retry can never double-bill a client.

Operational security

The practices that keep the platform hardened over time.

Ongoing security review & hardeningThe codebase is reviewed and remediated on a recurring basis — not a one-time exercise.

Least-privilege accessStaff and client roles are scoped to exactly what they need; sensitive actions are admin-gated.

Single-use, expiring reset linksPassword resets are 256-bit, one-time, time-limited, and enumeration-resistant.

Encrypted, non-web-served secretsEncryption keys and DB credentials live outside the document root and are never publicly reachable.

Automated backupsData is backed up for recovery, minimizing disruption in the event of an incident.

Maintained & patchedDependencies and the platform are kept current as fixes and improvements ship.

Responsible disclosure

Security researchers and partners: if you believe you've found a vulnerability, we want to hear from you. Report it privately and we'll acknowledge promptly and work with you on a fix.

[email protected]

No platform can be guaranteed 100% secure. This page describes the controls currently implemented in Blackhawk MSP and reflects a defense-in-depth approach aligned with the OWASP Top 10 and industry-standard cryptography. Specific safeguards may evolve as the platform is updated. It is not a certification or a contractual warranty.