BookPilotPassword protection
Passwords are not stored in plain text. The account service derives password hashes using PBKDF2 with SHA-256, a per-user random salt and 150,000 iterations.
Security
Practical controls around accounts and downloads.
BookPilot uses server-side access checks and browser security controls to protect account sessions and private product downloads.
Session protection
Sessions are stored server-side. The browser receives a Secure, HttpOnly, SameSite=Lax session cookie, and expired sessions are rejected by the server.
Abuse protection
Signup, login and password-reset endpoints use server-side rate limits. State-changing requests are checked against the site's origin before being accepted.
Browser hardening
Responses set security headers including HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame protection.
Private downloads
The Windows installer is designed to remain in private object storage rather than public website assets. The download endpoint checks the signed-in user and product-access status before streaming the file.
AI provider isolation
Ask BookPilot does not give an AI provider database credentials or direct write tools. External AI receives only the selected BookPilot context, with business names and free-text redacted by default.
Bring-your-own AI safeguards
Remote custom AI endpoints must use HTTPS. Private and LAN destinations are blocked; a model running on the same computer requires explicit owner/admin loopback permission. Provider redirects are not followed.
Guarded AI drafts
AI-prepared invoices, expenses and review suggestions remain unsaved proposals until the user reviews them. Reconciliation, payments, deletion, period close and HMRC submission remain BookPilot-controlled actions.
Reset and audit controls
Password-reset links expire after one hour and completing a reset invalidates existing sessions. Successful protected downloads are logged with account, file and security metadata; the connecting IP is recorded in hashed form.
Security reports
If you believe you have found a security issue, email support@bookpilot.uk with enough detail to reproduce it. Do not access data that is not yours or disrupt the service while testing.