> For the complete documentation index, see [llms.txt](https://boza.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://boza.gitbook.io/docs/settings-and-security/security-and-privacy.md). # Security Overview Boza is built with security and data protection at its core. We understand that connecting to your identity provider, collecting usage data, and managing your software portfolio requires a high level of trust. This section explains how we protect your data and what measures are in place. ## Hosting All data is hosted in **France** on **Scalingo** servers. Scalingo is a French sovereign cloud platform that runs on the infrastructure of **3DS Outscale** (a Dassault Systemes subsidiary). Data centers are located in France and are ISO 27001 certified. ## Compliance Boza is actively working towards **ISO 27001** certification to demonstrate our commitment to information security management. ## Data Protection Principles * **Data minimization** — Boza collects only the data necessary to deliver the service. * **Purpose-scoped integrations** — data synchronization is generally read-only, while clearly initiated workflows can provision or remove users, deliver messages, or deploy the browser extension through supported connectors. * **Anonymization** — usage data can be anonymized on request. * **Catalog-scoped browser signals** — the extension matches browser domains against a professional-application catalog and reports supported matches. It does not collect page content, form values, keystrokes, emails, or documents. ## Sub-providers | Provider | Role | | ----------------------------------- | ------------------------------------------------------------------- | | Scalingo | Cloud hosting (France, 3DS Outscale data centers) | | Google | Internal identity provider | | GitHub | Version control and CI/CD | | Amazon Textract, Google Document AI | OCR for uploaded invoices | | OpenAI | Extracting invoice data and generating/interpreting Boza AI queries | For details on invoice processing, Boza AI data flow and reuse, and exactly what is shared with each provider, see [Data Privacy & GDPR](/docs/settings-and-security/data-privacy-gdpr.md). ## Data Collected Boza collects the following categories of data through its integrations and browser extension: | Data Category | Source | Description | | ----------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------ | | IdP directory data | Google Workspace, Microsoft Entra ID | User name, email, job title, team, department, organizational unit | | SSO audit logs | Google Workspace, Microsoft Entra ID | Timestamps of sign-ins to third-party applications | | IdP license data | Google Workspace, Microsoft Entra ID | License assignments and subscribed SKUs | | Browser extension URLs | Boza browser extension | URLs of professional SaaS applications (matched against Boza catalog only), with connection timestamps | | Direct integration data | Notion, Atlassian, GLPI | Users and application usage data | | Finance data | Pennylane, Powens | Invoices and software-related bank transactions | ## Application Catalog Boza maintains a catalog of over **100,000 applications worldwide**. The browser extension matches visited URLs against this catalog to identify professional SaaS tools. URLs that do not match the catalog are not collected. ## Authentication Access to the Boza platform is exclusively through **Single Sign-On (SSO)**: * Google SSO * Microsoft SSO There are no standalone Boza passwords. Authentication is delegated entirely to your organization's identity provider. ## Security Measures | Measure | Details | | ---------------------- | ------------------------------------------------------ | | Encryption in transit | TLS 1.3 protocol | | SSL rating | A-rated on Qualys SSL Labs | | Tenant data separation | One database schema per tenant, preventing data mixing | | Database access | Not directly accessible from the internet | | Infrastructure access | Protected by multi-factor authentication (MFA) | | API security | Every request validated through signed, expiring JWTs | | Access control | SSO-only access; no standalone passwords | ## Learn More * [Data Privacy & GDPR](/docs/settings-and-security/data-privacy-gdpr.md) — detailed breakdown of data handling, GDPR compliance, and access controls. * [Microsoft Entra ID Scopes & Permissions](/docs/settings-and-security/entra-id-scopes.md) — the specific API scopes Boza uses when connecting to Microsoft. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://boza.gitbook.io/docs/settings-and-security/security-and-privacy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.