Security & Support Policy
Bulk's security responsibilities, support channels and the distinction between general safeguards and agreed service levels.
Effective
Our approach
ManagementSupport LLC, trading as Bulk, provides and operates software used for manufacturing and laboratory workflows. Security depends on the application, the deployed infrastructure, operating procedures and Customer’s own configuration and use. This document describes those responsibilities and the scope of general support. The DPA and a signed order’s security attachment govern agreed personal-data measures.
Bulk does not claim that it holds SOC 2, ISO 27001 or Cyber Essentials certification. A security-policy framework, a feature supporting an audit, or a hosting provider’s certification does not establish a certification of Bulk or validation of a customer’s regulated process.
Application safeguards
The application implements authenticated access, tenant/site scoping and role-based permissions, together with account and session controls. It supports MFA functionality and records operational activity. The availability of a feature is distinct from whether it is enabled and enforced for a particular deployment or user.
Audit history supports investigation and accountability; it must not be described as universal write-once storage or an independently certified immutable record. Support personnel may need authorised access to diagnose an issue. The permissions, access channels, logging and any impersonation or assistance mechanisms must be assessed for the relevant deployment.
Infrastructure and continuity
Bulk uses configured hosting, network, file-storage, backup and logging services. The applicable order must identify the required location and security arrangements. TLS protects connections where configured; it does not prove encryption of every disk, database, file or backup. Backup schedules and retention in infrastructure source are configuration evidence, not proof of successful backup or restoration.
Specific encryption coverage, backup location, recovery targets, retention periods and restore-test evidence must be verified before being stated as a contractual commitment. There is no general promise that every copy remains in the primary hosting country or is deleted immediately after account closure. The DPA processing schedule sets the required exit and retention arrangements.
Customer must maintain suitable devices, network access, operational contingency plans and any records or independent safeguards required by its own obligations. A backup service does not remove Bulk’s agreed recovery duties or Customer’s responsibility to validate the business process after recovery.
Diagnostics and remote assistance
Bulk may use logs, error reports and configured session replay to investigate problems. Product replay can be identifiable and may include displayed content; masking is not a guarantee that every sensitive item is excluded. Remote-control assistance requires a separate confirmation in the current integration. Customers must assess monitoring notices and lawful bases for their workforce and limit sensitive information in support requests.
How to contact support
Contact support@trybulk.app. Include the workspace, affected feature, approximate time, steps to reproduce and operational impact. Do not send passwords, private keys or access tokens. If supporting records are necessary, agree an appropriate transfer method. Public status information is available at status.trybulk.app.
We assess requests by impact and urgency, including suspected security incidents, inability to perform a core operation, degraded functionality and general assistance. A request acknowledgement is not a promise that the issue will be resolved within a fixed period. Account configuration, third-party integrations and customer networks may require Customer’s cooperation.
Service levels and maintenance
General support does not include a universal uptime percentage, 24/7 staffed desk, fixed response or resolution time, recovery point/time target, or service-credit entitlement. Those commitments apply only if specified in a signed order or service-level attachment, with the measurement method, hours/time zone, exclusions and remedies stated there.
Bulk may perform maintenance and security updates and will communicate material service effects where practicable. Emergency changes may be needed to protect the service. Maintenance handling and any availability exclusions must follow an agreed SLA where one exists; this policy does not silently create an exclusion from an existing commitment.
Incidents and vulnerability reports
Report a suspected incident or vulnerability promptly to support@trybulk.app, identifying the affected workspace and evidence without accessing additional information unnecessarily. Bulk will investigate and take appropriate containment and remediation steps. Personal data breach notices are governed by the DPA, including notice to Customer without undue delay after awareness. They are distinct from routine support tickets and public status messages.
This reporting channel does not authorise penetration testing or promise a bug bounty or safe harbour. Customer remains responsible for its own statutory notifications, with assistance as required under the DPA. Any regulator request should be handled consistently with applicable law and the Agreement.
Assurance requests and changes
Customers may request relevant security information through the support contact. Detailed architecture, access arrangements and evidence may be shared under confidentiality safeguards rather than published openly. The DPA defines audit rights; a request for evidence does not require Bulk to disclose another customer’s information or exploitable details publicly.
Material changes to agreed safeguards must follow the Agreement and must not reduce the protection required by the DPA. The current version of a public description does not retrospectively replace an order’s agreed service levels.