Last Updated: October 27, 2022
Application security
The Bunny engineering team strives to write secure code that aligns with industry best practice. We do peer reviews to ensure code quality and perform static code analysis to detect vulnerabilities that may exist in our dependencies.
Authentication
By default all Bunny user accounts are passwordless and accessed via
email. Bunny also supports SAML based single sign-on and user accounts
can be provisioned or deprovisioned from identity providers that support
the SCIM protocol.
Roles & permissions
Bunny is used by several types of users, from sales representatives
through to developers and finance executives. With this in mind we offer
role based access controls to limit the scope of data that each type of
user can view or modify.
Secure access
Bunny requires HTTPS for access to our application, quote, payment and
invoice portals as well as API.
API
Bunny utilizes the OAuth2.0 protocol to enforce secure access to our
APIs.
Our best practice security approach
Bunny is SOC 2 TYPE II certified. This certification provides
assurance that we are operating at a level that is in compliance or
better than the standards outlined by the American Institute of
Certified Public Accountants (AICPA).
We process all payments through PCI compliant payment gateway partners
such as Stripe. Bunny does not store credit card details or card
holder information.
Bunny operates servers hosted on Amazon Web Services (AWS). Access to
AWS is heavily restricted.
Bunny operates several systems to monitor the health of our service
and detect incidents. If a security incident occurs Bunny will notify
all affected customers with undue delay.
Please report any vulnerabilities to security@bunny.com . We will
immediately assign a ticket id number for each report and a member of
our engineering team will reply back within 1 business day.
How we handle your data
Security controls cover how your data is protected. What we collect, why we collect it, and who it is shared with are set out in our Privacy Policy, and the commitments we make in providing the platform are set out in our Terms of Service. Data residency options are covered on our data centers page.
FAQ
Frequently asked questions
Is Bunny SOC 2 certified?
Yes. Bunny is SOC 2 Type II certified, providing assurance that we operate at or above the standards outlined by the American Institute of Certified Public Accountants (AICPA).
How do users authenticate to Bunny?
By default all Bunny user accounts are passwordless and accessed via email. Bunny also supports SAML-based single sign-on, and user accounts can be provisioned or deprovisioned from identity providers that support the SCIM protocol.
Can we control what different users can see?
Yes. Bunny offers role-based access controls so that the scope of data each type of user can view or modify is limited — important when sales representatives, developers and finance executives all work in the same system.
Does Bunny store credit card details?
No. All payments are processed through PCI-compliant payment gateway partners such as Stripe. Bunny does not store credit card details or cardholder information.
Where is Bunny hosted?
Bunny operates servers hosted on Amazon Web Services (AWS), with heavily restricted access to the AWS environment.
How is data secured in transit and via the API?
Bunny requires HTTPS for access to the application, the quote, payment and invoice portals, and the API. API access is secured using the OAuth 2.0 protocol.
How does Bunny handle security incidents?
Bunny operates several systems to monitor service health and detect incidents. If a security incident occurs, Bunny notifies all affected customers without undue delay.
How do I report a vulnerability?
Report vulnerabilities to security@bunny.com. Each report is immediately assigned a ticket ID and a member of the engineering team replies within one business day.
How does Bunny keep its own code secure?
The Bunny engineering team writes code that aligns with industry best practice, performs peer reviews to ensure code quality, and runs static code analysis to detect vulnerabilities in dependencies.