Security at PHP Business Solutions

Security principles

• Least privilege: users and integrations receive only the access needed for their role.
• Server-side enforcement: protected actions do not rely on hidden buttons or client-side checks.
• Organization isolation: client users are scoped to their own organization and deny-by-default when membership is missing.
• Validated boundaries: public input is capped, validated, parameterized, and protected by abuse controls.
• Human review: sensitive communications, financial decisions, unusual exceptions, and consequential actions retain approval steps.
• Operational visibility: important actions, failures, and administrative changes have logging and notification foundations.

Platform controls

The website uses encrypted connections and managed hosting. Client access is restricted to approved users and their organization. Public forms validate submissions and include abuse controls, while protected actions are checked on the server.

Client engagement practices

Before an automation is launched, we identify the data involved, systems and permissions, exception paths, human approvals, failure notifications, ownership, and test plan. Requirements for regulated or particularly sensitive data must be agreed in writing before access is provided.

Responsible disclosure

If you believe you found a security issue, email nolan@phpbusinesssolutions.com with “Security report” in the subject. Include the affected page, steps to reproduce, potential impact, and a safe way to contact you. Do not access other users’ data, disrupt service, use social engineering, or publicly disclose an unresolved issue. We do not currently offer a bug bounty.

Requirements for your business

Each engagement has its own data, people, and responsibilities. We agree on access, retention, recovery, and incident contacts before connecting your systems, and verify the controls needed for that scope.