Security
Barvol is built with security as a first-class requirement. This page documents how we protect your account, your data, and your integrations.
Authentication
Barvol uses email and password authentication with secure session tokens. Sessions expire after 30 days of inactivity. You can view and revoke active sessions from Account Settings, Security tab.
We do not support third-party social login (Google, GitHub) as an authentication method at this time. All accounts use email and password.
Two-factor authentication (2FA)
Barvol supports TOTP-based two-factor authentication (compatible with Google Authenticator, Authy, 1Password, and any TOTP-compatible app). Enable 2FA from Account Settings, Security tab.
When 2FA is enabled, you are prompted for your 6-digit code after entering your password on each new device. 2FA is strongly recommended for all accounts, especially workspace owners.
During 2FA setup, you will be shown recovery codes. Save these codes in a secure location — they are the only way to access your account if you lose access to your authenticator app. Recovery codes can be regenerated at any time from the Security tab, which invalidates the previous set.
OAuth integration security
All integrations use OAuth 2.0. Barvol never stores your integration passwords. OAuth tokens are stored encrypted at rest using AES-256 encryption. Tokens are stored separately from application data in a dedicated secrets store.
You can revoke any integration's access at any time from the Integrations page. Revoking access in Barvol invalidates the stored token immediately — the integration stops syncing within minutes.
Data encryption
All data transmitted to and from Barvol is encrypted in transit using TLS 1.3. Data at rest is encrypted using AES-256. Integration OAuth tokens are stored in a dedicated secrets vault with access logging.
Database access is restricted to Barvol's application servers. There is no direct database access from the internet.
Session management
To view all active sessions for your account, go to Account Settings, Security tab, and scroll to "Active sessions." Each session shows the device type, browser, and last-active time. Click "Revoke" next to any session to immediately invalidate it — for example, if you left yourself logged in on a public computer.
You can also click "Revoke all other sessions" to log out every device except the one you are currently using.
Reporting security issues
If you discover a security vulnerability in Barvol, report it responsibly by emailing security@barvol.online. Include a detailed description of the issue and steps to reproduce it. We acknowledge all reports within 48 hours and aim to resolve critical issues within 7 days.
Please do not disclose the vulnerability publicly until we have had a chance to address it.