Security

Blue is designed from the ground up for security and scale.

Last updated: April 21, 2026

Blue delivers enterprise-grade security and seamless scalability for your critical processes. Designed for high availability and trusted by 19,000+ teams in 120+ countries, Blue powers your global operations with confidence.

Our platform is built on a robust architecture that prioritizes both security and scalability from its core. We understand that as your business grows, your process management needs evolve, and Blue is designed to grow with you. Whether you’re a small team or a large enterprise, our system can handle your workload efficiently and securely.

Secure & Scalable Platform

Blue ensures the highest level of security and scalability for your process management needs. Our enterprise-grade measures protect your data and enable you to grow without limits.

We’ve implemented defense-in-depth security architecture with multiple protective layers:

API Protection

  • Operation-specific rate limiting: Every API operation has its own Redis-backed limit. General operations, exports, and security-sensitive endpoints have progressively tighter caps, enforced at the per-key, per-user, and per-organization level so abuse on one account never affects another.
  • Query depth limiting: GraphQL queries are capped at 10 levels deep to prevent circular query attacks, with warnings emitted as queries approach the limit.
  • Request size limits: 256MB for GraphQL operations and up to 4.8GB for direct file uploads, with Content-Length validated before any byte reaches object storage.
  • Security headers: Helmet.js enforces HTTP security headers on every response.

Data Protection

  • Input sanitization: User-generated HTML is sanitized with a strict whitelist via DOMPurify, blocking script tags, inline event handlers, data: URIs, and custom protocols.
  • SQL injection prevention: Parameterized queries through Prisma ORM eliminate SQL injection risks.
  • XSS protection: Vue 3 template auto-escaping on the frontend combined with server-side sanitization on ingestion.
  • File upload validation: MIME type verification, extension validation, filename sanitization, and pre-upload size guards for all uploads.

Enterprise-Level Encryption

Blue implements military-grade AES-256-GCM encryption with authenticated encryption to protect your sensitive data.

We use AES-256 encryption in Galois/Counter Mode (GCM) with PBKDF2 key derivation using 100,000 iterations. This authenticated encryption not only protects your data but also ensures it hasn’t been tampered with. Each encryption operation uses a unique salt and initialization vector (IV), making every piece of encrypted data cryptographically unique.

All data transmitted between your devices and our servers is encrypted using TLS 1.2 or higher, with WebSocket connections automatically upgrading to WSS (WebSocket Secure) for real-time features. Public TLS certificates are issued by Let’s Encrypt via Caddy and rotated automatically. Internal database traffic between application and MySQL servers is also encrypted with TLS 1.2+ using dedicated 4096-bit RSA certificates managed through Ansible.

Advanced Protection Systems

Blue employs multiple layers of automated protection to ensure platform security and reliability.

Real-Time Protection

  • Redis-backed distributed rate limiting: Distributed across all servers with per-key, per-user, and per-organization dimensions so abuse from one account can’t affect another.
  • Automated threat detection: Failed authentication attempts and suspicious patterns trigger automatic protective measures.
  • Query complexity analysis: Deep GraphQL queries are limited to 10 levels with logging for queries approaching limits.
  • Feature-flag enforcement: Custom role permissions are enforced on both read and write paths server-side, so role-bypass attempts fail even with direct API access.
  • Plan-limit enforcement: Structured quota errors on every mutation that affects billable resources (workspaces, automations, file size, custom fields, etc.), with locked-organization bypass prevention.

Infrastructure Security

  • SSH hardening: Public-key authentication only, limited login attempts, and fail2ban for brute-force mitigation on every server.
  • Host firewall: UFW restricts access to the minimum ports required for application and internal service traffic.
  • Secrets management: Infrastructure secrets are stored in Ansible Vault; application secrets are injected at deploy time rather than committed to source control.
  • Environment-based security: Separate configurations and credentials for development, staging, and production environments.
  • Key rotation support: Separate secrets for access and refresh tokens enable independent key rotation.
  • High-availability database: A replicated MySQL pair (primary + replica) with automatic failover via Replication Manager keeps writes flowing if a node fails.

Multi-Layer Authentication & Authorization

Blue implements a sophisticated authentication system with multiple layers of protection.

Authentication Methods

  • Dual-token JWT system: Short-lived access tokens (15 minutes) paired with longer refresh tokens (60 days) minimize exposure windows.
  • Personal Access Tokens (PAT): For API integrations, hashed with bcrypt before storage and validated on each request.
  • Firebase Authentication: User passwords are managed by Google Firebase Authentication — Blue never sees, stores, or hashes plaintext passwords.
  • Email-based security codes: Time-limited codes for sensitive operations, indexed by email, category, and expiry, and invalidated immediately after use.

Fine-Grained Authorization

Our GraphQL API uses Shield middleware to enforce permissions at the field level. We implement role-based access control (RBAC) with six distinct permission levels: Owner, Admin, Member, Client, View Only, and Comment Only. These permissions are context-aware, checking both organization-level and workspace-level access for every operation.

Beyond standard roles, Blue supports custom user roles that enable even more granular access controls. Organizations can create tailored roles with specific permissions like canCreateRecords, canEditRecords, canDeleteRecords, and canViewAnalytics, allowing precise control over what each team member can do. Custom roles can be applied at both organization and workspace levels, enabling different permission sets across different workspaces. Special rules handle archived workspaces and inactive organizations to ensure data remains protected even in edge cases.

On top of record-level roles, Blue enforces field-level permissions: custom roles can restrict viewing and editing of specific field types — for example, preventing client-tier users from modifying assignees, tags, due dates, or record dependencies. These checks run on every read and write path server-side through GraphQL Shield, regardless of the client making the request.

Continuous Security Monitoring

Blue implements comprehensive monitoring to maintain security integrity.

Our systems include real-time monitoring for security events, failed authentication attempts, and unusual access patterns. Rate limiting automatically prevents brute force attacks, while query depth limiting protects against resource exhaustion. All security-relevant events are logged with detailed audit trails, enabling rapid investigation of any suspicious activity.

Data Residency & EU Hosting

All Blue infrastructure — application servers, primary and replica databases, and backups — runs in Hetzner’s Germany (FSN1) data center. This gives every Blue customer EU data residency by default:

  • GDPR-aligned by design: Personal data processed through Blue never leaves the European Union, supporting GDPR, UK GDPR, and Australian Privacy Act requirements without additional cross-border transfer safeguards.
  • Sovereign processing: No reliance on US cloud hyperscalers for primary workloads, reducing exposure to non-EU jurisdictional data requests.
  • Low-latency replication: Replica databases sit in the same region as the primary, keeping failover fast and cross-node latency minimal.

Customers requiring additional compliance coverage can self-sign a Data Processing Agreement (DPA) and, for regulated industries, the applicable Business Associate Agreement (BAA), Health Data Addendum, or sector-specific addendum directly in their organization settings.

Daily Data Backups

Your data is backed up daily to ensure data integrity and enable quick disaster recovery if needed.

Our layered backup strategy minimizes data loss and speeds up recovery:

  • Daily incremental backups (Monday–Saturday) capture every day’s changes.
  • Weekly full backups (Sunday) provide a clean recovery baseline.
  • Hourly binary log sync streams transaction logs offsite, keeping our recovery point objective at 1 hour or better.
  • Retention: 30 days of daily backups and 12 weeks of full backups (3 months total).
  • Offsite encrypted storage: All backups are compressed and encrypted before streaming to Backblaze B2.
  • Recovery targets: 10–20 minutes for local restores; 1–2 hours for full restores from offsite storage.

Additionally, our platform implements comprehensive session security:

Session Management

  • Secure cookies: All session cookies use httpOnly (preventing JavaScript access), secure (HTTPS-only), and sameSite=‘strict’ (CSRF mitigation) flags.
  • Token rotation: Refresh tokens are automatically rotated on sign-in to prevent token replay attacks.
  • Domain isolation: Multi-tenant security through domain-specific cookie settings.
  • Automatic expiration: Sessions expire after defined periods with secure cleanup of authentication artifacts.

Technical Security Implementation

Blue’s security is built into every layer of our application architecture.

Frontend Security

  • No local storage of auth tokens: Authentication tokens are managed entirely by the Firebase SDK and are never written to localStorage. Only non-sensitive UI state (theme, organization context, login hint) persists locally.
  • Automatic token refresh: Tokens are refreshed seamlessly before expiration, with a shared refresh promise to prevent thundering-herd calls after periods of inactivity.
  • Route guards: Every authenticated route validates session, organization membership, workspace access, and module-level permissions before rendering.
  • Form validation: HTML5 validation (email, phone, required, pattern) combined with dedicated client-side validators (for example, libphonenumber-js for international phone numbers) catches errors before they reach the server.

Backend Security Architecture

  • GraphQL Shield: Every API operation is protected by specific permission rules.
  • Prisma ORM: Type-safe database queries prevent injection attacks.
  • Redis-backed systems: Rate limiting, session management, and job queues use Redis for performance and reliability.
  • Audit logging: Security-sensitive operations are logged for compliance and debugging.

Password & Token Security

  • Firebase-managed passwords: User passwords are handled by Google Firebase Authentication and are never stored in Blue’s own systems.
  • BCrypt-hashed tokens: Personal Access Tokens are hashed with bcrypt using appropriate work factors before storage.
  • Secure comparison: Timing-safe comparison functions prevent timing attacks.
  • One-time codes: Email-based security codes are invalidated immediately after use.