Security
How we keep your yards safe
Your house and your shop live in Both Yards, so we take looking after them seriously. Here is, in plain words, what we actually do today.
Your house and your shop live in Both Yards, so we take looking after them seriously. Here is, in plain words, what we actually do today.
Turn it on in Account and we ask for a 6-digit code after your password. Use any authenticator app, or have a code emailed to you.
You also get 10 backup codes, each good for one use, in case your phone is out of reach. Turning two-step sign-in on or off, or making new backup codes, always needs your current password. How to set it up.
New accounts confirm their email address before the first sign-in. The link we send works for 24 hours.
Password reset links work for 1 hour, and after a reset we sign you out on your other devices.
We keep a salted, one-way scrypt hash of your password, never the password itself. Not even our team can read it. Passwords need at least 8 characters.
Signing in, password resets and code checks all have limits. After a few tries in a row we ask you to wait a little, which makes guessing passwords or codes impractical.
Every page on bothyards.com and app.bothyards.com is served over HTTPS. Plain http addresses redirect to the secure ones, and we tell browsers to always use the secure connection (HSTS).
Payments go through Stripe’s own checkout and billing pages. Your card number goes straight to Stripe. We never see or store it.
Each place has its own people and roles: Owner, Member and Viewer, plus ready-made presets like Manager, Field, Counter and Books. Owners choose who sees money, payroll or stock. Home and Work stay separate, so your crew never sees the house.
Every night we make an encrypted copy of the database and send it off-site. It is encrypted before it leaves our server, and we check every upload. We keep the last 7 daily and 4 weekly copies.
We also make a local copy each night and test-restore it before we keep it.
You can delete your account yourself in Account → Delete account. We sign you out everywhere, cancel any paid plan you run, and hide the places you own. For 30 days you can sign back in and restore everything. After that, the login and those places are removed for good. Deleted places get the same 30-day window.
Copies inside our encrypted backups age out as those backups are replaced, within about five weeks.
If you think you have found a security problem in Both Yards, please email support@bothyards.com with Security in the subject line. Our team reads every report.
The same contact is published in our security.txt.
Our team is happy to explain anything on this page.