1. How we protect this site
- Mandatory encrypted connections (HTTPS with HSTS) and redirection of secondary domains to the main one.
- A strict content security policy: the site runs no third-party scripts, cannot be embedded in other pages and blocks external frames.
- Security headers (X-Content-Type-Options, Referrer-Policy, Permissions-Policy, origin isolation).
- Forms that validate the origin, size and fields of every request, with rate limits against abuse and bot traps.
- Credentials and secrets stored only in the server’s secure configuration, never in code.
- Teams booking only accesses the service mailbox calendar, with permissions limited to that mailbox.
- Data stored outside the public folder and automated security tests before every release.
2. How we protect client information
We apply least privilege, multi-factor authentication on administrative accounts, access only with the client’s authorization and a log of the activities we perform on their platforms, and confidentiality during and after each service. Our products (Barona Contable and Barona POS) have their own security policies, published at Barona Contable security and Barona POS security.
3. Incident management
If we detect an incident affecting personal data or client information, we contain it, investigate its cause, inform those affected without undue delay and, when the law requires it, report it to Colombia’s Superintendence of Industry and Commerce within the established deadlines.
4. Responsible vulnerability disclosure
If you find a possible vulnerability in our site or products, write to info@baronaenterprise.com with the subject “Security”, describing the issue and the steps to reproduce it. We ask you to:
- Not access, modify, download or delete other people’s information; use only your own or test accounts.
- Not perform denial-of-service, social engineering, spam or physical attacks.
- Give us reasonable time to fix the issue before disclosing it.
We reply within three (3) business days and keep you informed. We will take no action against anyone reporting in good faith under these rules. This information is also published at /.well-known/security.txt.
5. What we will never ask you for
We will never ask for passwords, verification codes, card details or remote access to your devices without an agreed, verifiable service. If someone does so in our name, report it to info@baronaenterprise.com.
Version 2026.10, effective as of October 7, 2026. The Spanish version prevails.
