Trust and Security

Our clients trust us with permits, lab results, and the records regulators rely on. This page explains how we protect that information, and it is where we post an update whenever we complete security work that affects our platforms.

How We Protect Your Data

The Practices Behind Every Platform

Each Client's Data Stays Separate

Every client record is protected by access rules enforced in the database itself, so one client can never see another client's information.

Private Document Storage

Reports, lab results, and permits are stored privately. Nothing is published to an open link.

Encrypted Connections

Every connection to our websites and client portal is encrypted between your browser and our servers.

Admin Access Stays Server-Side

Administrative credentials live only on our servers. They never reach a web browser or a client device.

Fast Response to Provider Incidents

When a provider we rely on reports a security incident, we replace every credential it held, starting with the ones that grant the most access.

Ongoing Review

We check our platforms against current security advisories, and every fix goes through a reviewed change process before it ships.

Security Updates

What We've Done, and When

Each update is posted once the work it describes is complete. The newest is first.

Security UpdateOctober 24, 2026

Response to a Third-Party Infrastructure Incident

On October 21, a third-party infrastructure provider we use disclosed that an unauthorized party may have accessed credentials stored on its platform. We began rotating credentials that same evening, starting with those that grant the most access, and replaced the large majority by October 22.

On October 23 and 24, we completed a full security review of every BCG Water platform, covering dependencies, runtimes, access permissions, and the connections between our systems. The resulting improvements are now in review before deployment.

We will post an update here as each stage is completed.

Responsible Disclosure

Report a Concern

If you believe you have found a security issue in any BCG Water website or platform, email security@bcgwater.com. Please include enough detail for us to reproduce it, and give us a reasonable chance to fix it before sharing it publicly. We read every report and will reply.

Security researchers can also find our contact details in our security.txt file.

Ready When You Are

Questions About How We Handle Your Data?

We're glad to walk you through our practices, or complete your organization's security questionnaire.

And we believe water deserves nothing less.