Data ownership

AuxBOS is delivered as software you install on your own server. Every employee record, every client conversation, every screenshot, every financial document — none of it ever touches AuxWork's infrastructure under normal operation. You choose where the data lives (on-prem, private cloud, region-specific hosting), you control the backups, you control the retention.

Compare that to hosted SaaS, where your customer data lives on a vendor's shared infrastructure and you're one breach away from becoming an incident notification. Self-hosted removes that risk category entirely.

Authentication & sessions

AuxBOS uses two complementary sign-in mechanisms:

  • Admins sign in with their email address plus a strong password.
  • Employees and clients sign in with system-issued unique User IDs (e.g. EMP-12-A4K9P). This prevents credential collision, allows people without company email to have accounts, and simplifies revocation.

Every authenticated request is validated with a signed JWT. Server-side sessions provide the second layer, so a compromised JWT alone isn't enough to maintain unauthorised access.

Password storage

Passwords are stored as one-way hashes using PHP's password_hash() (currently bcrypt cost 12). We never store plain-text passwords. When a password is reset, a new strong password is generated server-side, emailed to the account owner, and the previous hash is invalidated. Nobody — not even the local admin — can recover the original.

Roles & permissions

Access to every module is role-controlled. Admins define roles, grant each role access to specific modules, and assign employees. An employee only sees the parts of AuxBOS their role permits. Default roles ship for common patterns (Admin, HR, Sales, Accountant, Employee, Client) and can be extended.

Multi-tenant isolation

Under the hood, AuxBOS is multi-tenant. Every record belongs to a company, and every server-side request is scoped to the company of the signed-in user. One company's data is never accessible to another — enforced at the query layer, not just the UI layer.

Transport security

The AuxBOS marketing website enforces HTTPS with:

  • Automatic redirects from HTTP to HTTPS at the web-server level
  • HTTP Strict Transport Security (HSTS) header telling browsers to always use HTTPS
  • Modern cipher suites via the hosting provider's TLS termination

Your self-hosted AuxBOS install inherits your infrastructure's TLS configuration — we recommend a Let's Encrypt certificate with auto-renewal at minimum.

Application-level hardening

  • HTTP security headers — CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy are all set on every response.
  • SQL injection protection — every database query uses prepared statements via PDO. No user input is ever concatenated into SQL.
  • XSS protection — all user-supplied content is escaped on output using the centralised e() helper. Rich-text fields use a strict allow-list.
  • File upload validation — MIME type + extension checks, size limits, and served through permission-checked endpoints rather than direct URLs.
  • Rate limiting on authentication endpoints to slow credential-stuffing attempts.

Compliance-friendly by design

Because AuxBOS is self-hosted, most compliance conversations become dramatically shorter:

  • GDPR / UK-GDPR — you are the controller; there's no cross-border processor agreement to negotiate.
  • Pakistan PDPB — data can stay entirely within Pakistan if you deploy on local infrastructure.
  • Saudi NDMO — personal data of Saudi residents can stay inside the Kingdom with a KSA deployment (see the Saudi Arabia hub).
  • SOC 2 / HIPAA / ISO 27001 — the platform is one component of your own audit scope, not a separate vendor requiring its own attestation.

Responsible disclosure

If you've found a security issue in AuxBOS, this website, or any AuxWork-operated infrastructure, please report it via:

We acknowledge every report within 3 business days. Please give us reasonable time to investigate and ship a fix before public disclosure — coordinated disclosure protects licensees running their own installs who may take longer to patch.

Third-party services used by the marketing website

The AuxBOS marketing site (the pages under auxbos.com) uses a small, deliberately limited set of third-party services:

  • Google Fonts — Poppins and Kanit typefaces (styles + font files)
  • Font Awesome via cdnjs.cloudflare.com — icon set
  • Leaflet + OpenStreetMap — interactive map on the contact page only
  • FormSubmit.co — delivers contact-form submissions to our team inbox

All are declared in the site's Content Security Policy header. No analytics, no advertising trackers, no session-recording tools are loaded by default.

Last updated: November 2, 2026. We update this page whenever the platform's security posture changes materially.