BMC One
BMC One security
These are the measures that protect your data in BMC One. Each one has been checked in our infrastructure or our code; if we cannot prove it, we do not publish it.
Where your data lives
- BMC One and its database run on dedicated Hetzner servers in Falkenstein, Germany.
- The documents you upload to BMC One are stored on those same servers.
- The database is not exposed to the internet: it can only be reached over an encrypted private network.
Encryption
- Every connection uses HTTPS, with TLS 1.2 as a minimum and HSTS.
- The database and documents sit on disks encrypted with AES-256.
- Electronic certificates, bank credentials and integration secrets are also encrypted one by one with AES-256-GCM.
Access
- You sign in with a single-use link that expires after 24 hours, with no password.
- Each client sees only its own companies' data.
- Sessions use secure cookies (HttpOnly, Secure and SameSite).
- API tokens support expiry, an allowlist of IP addresses and permissions by area, resource and action.
- The MCP server connects with OAuth 2.1 and PKCE, using access tokens that expire after one hour.
Logging and traceability
- Sensitive operations are written to an audit log chained with SHA-256 hashes, so any later tampering is detectable.
- If we hold your electronic certificate, BMC One shows you every use we make of it and lets you download that log as CSV.
- BMC Sign applies an advanced electronic signature (PAdES) with a qualified timestamp.
Backups and monitoring
- Encrypted daily backups, kept off the origin server.
- Files you upload are scanned for malware before they are stored.
- An intrusion detection system automatically blocks addresses that attack our servers.
Your rights over your data
- Data Protection Officer: Bárbara Botía, dpo@bm.consulting.
- From BMC One you can request an export or the erasure of your data.
- We keep every consent you give together with the version of the text you accepted.
A question about security?
Write to plataforma@bm.consulting. For data protection, to dpo@bm.consulting.