Skip to content

Security at Bavua

Your screen content never touches our servers. Here's every detail of how we keep it that way.

Security Architecture

Your Screen Stays Off Our Servers

Screen content travels directly between your own devices on your local network. Bavua servers handle sign-in, device discovery, and billing — they never receive, process, or store your screen content.

Encryption in Transit

Traffic between the Bavua apps and our servers is encrypted with HTTPS (TLS). The screen stream between your devices is not encrypted in transit on your local network, so use Bavua on networks you trust.

Peer-to-Peer by Default

On local networks, the screen stream flows directly between your devices with no cloud involvement.

Minimal Data Collection

We collect only what's necessary: account info from your sign-in provider (name, email, profile photo URL, account identifier), device details (name, model, OS version, an app-generated device ID, local network IP address), session metrics (start and end times, duration, frame rate, latency), and error reports. We never collect screen content, keystrokes, file contents, or browsing history.

Encryption Specifications

Component
Specification
App to Bavua Servers
HTTPS (TLS)
Screen Stream (Local Network)
Not encrypted
Authentication Tokens
HMAC-SHA256 JWT
Password Storage
bcrypt (12 rounds)
Webhook Verification
HMAC-SHA512

Compliance

GDPR

Compliant

Full compliance with the EU General Data Protection Regulation. Data processing agreements available.

POPIA

Compliant

Compliance with South Africa's Protection of Personal Information Act.

CCPA

Compliant

California Consumer Privacy Act compliance with data access and deletion support.

Security Practices

  • API endpoints that handle account data require a signed access token (JWT)
  • Refresh tokens are stored server-side with per-device tracking
  • Rate limiting on all endpoints (global, per-user, per-action)
  • HMAC-SHA512 webhook signature verification for Paystack
  • IP allowlisting for payment webhook origins
  • Input validation and sanitization on all user inputs
  • CORS with explicit origin allowlist
  • Security headers: HSTS, X-Frame-Options, CSP, Referrer-Policy
  • bcrypt password hashing with 12 salt rounds
  • Automated stale session cleanup and subscription expiry enforcement
  • Structured logging of business events
  • Graceful shutdown with active session termination

Data Residency

European Union (Ireland)

Amazon Web Services (eu-west-1)

API

Database

MongoDB Atlas

Account, device, and session records

Global Edge Network

Cloudflare

Web frontend, static assets

Enterprise customers can request custom data residency configurations. Contact security@bavua.co.za.

Responsible Disclosure

Found a security vulnerability? We take security seriously and appreciate your help keeping Bavua safe.

Please report security vulnerabilities to security@bavua.co.za. Include a description of the vulnerability, steps to reproduce, and potential impact.

We commit to acknowledging reports within 24 hours and providing a resolution timeline within 72 hours.