Security
Last updated
How we look after your data
Stebly keeps the books, stock and sales of real businesses, our own included. This page sets out the safeguards in Stebly today, and what you can do on your side.
Each business kept apart
Every business has its own workspace. Each record carries its workspace, and Stebly checks it on every read and every save, so one business can neither see another's records nor link to them.
Signing in
Every connection to Stebly is encrypted (HTTPS). Passwords are stored only as BCrypt hashes, never as the password itself. After five wrong passwords in 15 minutes, Stebly stops taking sign-ins for that login from that address for 15 minutes.
Rights, approvals and locked periods
Each role gets its own rights on every screen: view, create, edit, delete, approve, cancel and export. Documents can wait for approval in one inbox, and a closed period can be locked so that nobody changes it.
Every change on record
The audit log keeps who changed what and when, with the old and the new value, for documents and masters alike.
Backups and your own copy
Stebly backs up your data every night to your own Google Drive or OneDrive, once you connect one, and you can download a backup or restore from it. You can also download all your data at any time. Our servers are in India.
Files you upload
Stebly accepts only pictures, PDFs, office documents, text and CSV files, and checks that each file really is what its name says.
Our suppliers
We use established providers for hosting, email and messaging, and give each only the data its job needs.
If something goes wrong
If a security incident affects your data, we tell you promptly what happened and what you can do, and report it to the authorities as Indian law requires.
Reporting a security issue
Found a weakness in Stebly or this website? Write to hello@stebly.com with the details. Please do not access other people's data or disrupt the service while you look, and give us time to fix the issue before you tell anyone else. We thank everyone who reports responsibly.
What you can do
- Use a strong password that you use nowhere else.
- Give each person their own login, with only the rights their work needs.
- Switch off the login of anyone who leaves.
- Connect a backup drive, and look through the audit log now and then.