Trust

Security and trust

How we protect our own operation and our clients'. We apply in-house what we deploy for others.

Practices

How we work

Identity and access

MFA required on admin accounts and for remote access
Named accounts: never shared users
Least privilege and separate admin accounts
In your environment, delegated access with minimal roles and an expiry (for example, GDAP in Microsoft 365) instead of admin passwords
We revoke our access when each project closes

Data protection

Encryption in transit (TLS) on all our sites and applications
Secrets and credentials in Azure Key Vault, never in mail or chat
The contact form stores nothing: it opens your email and WhatsApp
Your company's data is never used to train AI models

Secure operations

Devices and servers with Microsoft Defender and managed updates
Internal applications behind Zero Trust (Cloudflare Access)
Code review plus secret and dependency scanning before release
Changes through version control, with an auditable history

Privacy and compliance

Privacy notice under Mexico's personal data protection law
Verifiable legal name, legal representative, and contact
Electronic invoice (CFDI) on every sale
A public channel to report vulnerabilities

Vulnerability reporting

If you find a security issue in our sites or services, email security@baux.xyz. We acknowledge and follow up. The contact is also published in security.txt.security.txt

Manufacturers and channel

We source hardware and licenses through wholesale distributors. We name Microsoft, Cloudflare, and other manufacturers to describe the platforms we work with; any manufacturer designation or program will be published only once it is in effect.

Privacy notice ·Terms ·Cookies

Shall we talk about your environment?

Tell us how many users, sites, or applications you have and what you want to solve. We reply with a written scope and quote.

Get a Quote About