Billy is built for small businesses that need their customer data handled carefully. Here is exactly how we protect it, in plain English, with no marketing fog.
The controls that protect your account and your customers' information.
Every page and every API call runs over HTTPS/TLS. We enforce HTTPS with HSTS, so browsers refuse to connect over an unencrypted link. Data your customers enter is encrypted the moment it leaves their device.
Your contacts, deals, and companies are scoped to your workspace. Every record is tied to your account, and every query filters by it, so one customer's data is never visible to another.
You log in with a one-time magic link sent to your email. There is no password for us to store or for an attacker to steal. Sessions expire and can be signed out at any time.
Outbound email is sent through authenticated infrastructure with SPF, DKIM, and DMARC. That protects your domain reputation and makes it far harder for anyone to spoof messages in your name.
Every e-signature is stored with a SHA-256 fingerprint and a full audit trail (timestamp, IP address, and consent event). A signed contract cannot be altered without breaking the fingerprint.
Public forms are gated with a per-account key and spam filtering, and account actions are protected against cross-site request forgery. Bad requests are rejected before they touch your data.
Unlike a locked platform, your records stay portable and under your control.
We do not reinvent the hard parts. Billy runs on established providers that maintain independent security certifications.
These providers encrypt data at rest and maintain SOC 2 Type II certification for their platforms. Certification refers to each vendor's infrastructure. Billy itself is a small, growing product, and we are transparent about that rather than claiming certifications we do not hold.
If you spot a security issue, or you just want to understand how something works before you trust us with your data, email bill@treetopgrowthstrategy.com. We answer security questions directly, not with a ticket number.