Security

Last updated: 15 October 2026

Businesses trust us with their software, licence keys, projects and data. This page explains how TresBizz protects your information and your purchases, how we handle incidents and what you can do yourself to stay safe.

Our approach

Security is part of everything we do, from the way we run our webshop to the way we build software for customers. We follow recognised good practice for information security, such as the principles in ISO/IEC 27001 and the OWASP guidelines for web applications, and we scale our measures to the risks of the data involved. We review our measures regularly and improve them when technology, threats or our services change.

Secure shopping

Every page of tresbizz.com is served over an encrypted HTTPS connection (TLS). Your browser shows a padlock when the connection is secure.
Card payments are handled by Stripe, a PCI DSS Level 1 certified payment provider. Card details go directly to Stripe. We never see or store your full card number or security code.
Payments are screened automatically for fraud to protect you and us. Suspicious orders are reviewed by a person before delivery.
Every order comes with an official VAT invoice from the TresBizz company named at checkout.
Our forms are protected against spam and bots with hCaptcha.
Customer account passwords are stored only as secure hashes and cannot be read by our staff.

Genuine licences and safe delivery

We sell genuine, new licences and subscriptions sourced from software publishers, authorised distributors and verified supply partners. Every supply partner is checked before we work with them.
Licence keys are delivered by email and in your customer account, and are only visible to you.
Subscriptions are registered to your own email address or tenant, so you stay in control of your licences and can manage them directly with the publisher.
Every purchase is covered by the TresBizz Guarantee: your key works, or we replace it or refund you in full. Our help desk checks the activation status of a key when you contact us.
Keep your licence keys private and do not share them publicly. If a key is lost or exposed, contact us as soon as possible.

Protecting data in our organisation

People

Staff and contractors who handle customer data are bound by confidentiality obligations.
We make our team aware of security risks such as phishing and social engineering.
When someone leaves or changes role, their access is removed or adjusted promptly.

Access control

Access to customer and order data is limited to staff who need it for their work (least privilege).
Administrative accounts are protected with strong passwords and two-factor authentication where available.
Shared accounts are avoided, so actions can be traced to a person.

Systems and infrastructure

Our website runs in a professional hosting environment with server-level protection provided by our hosting partner.
The website, plugins and other software are updated regularly with security patches.
Changes to our website are tested on a separate staging environment before they go live.
We make regular backups so data can be restored after an incident, and we test that backups can be restored.
We monitor our website for errors, unusual activity and downtime.

Service providers

We work only with service providers that offer appropriate security, and we review their security information before we use them.
Providers that process personal data for us sign a data processing agreement.
Payment, hosting and email providers we use are established companies with their own security programmes and certifications.

Data minimisation and deletion

We collect only the data we need and keep it only as long as needed, as described in our privacy policy.
Old data is deleted or anonymised according to our retention periods.

Security in custom software and website projects

When we develop software or websites for you, we apply secure development practices:

security and privacy requirements are discussed at the start of each project;
code is version controlled and changes are reviewed before release;
passwords, API keys and other secrets are never stored in code and are shared only through secure channels;
we test on staging environments and use test data instead of live personal data where possible;
we protect against common web vulnerabilities, such as injection, cross-site scripting and broken access control, following OWASP guidance;
we keep frameworks, libraries and plugins up to date during maintenance contracts;
access you give us to your systems is used only for the project and removed when it is no longer needed.

Email and phishing

Our email domain is protected with SPF, DKIM and DMARC to make spoofing harder. TresBizz will never ask you for your password, full card number or a payment to a new bank account by email or phone.

Signs of a phishing message include an unexpected request for payment, a slightly different sender address, urgent pressure to act, spelling mistakes and links to unknown websites. If you receive a suspicious message that appears to come from TresBizz, do not click links or open attachments, and forward it to info@tresbizz.com. If our bank details ever change, we will confirm this through a separate channel. When in doubt, call us before you pay.

Protect your account and software

Use a strong, unique password for your TresBizz account, ideally with a password manager.
Log out on shared computers and do not let your browser save passwords on them.
Keep your operating system, browser and software up to date.
Only download software from official publisher sources or the links we provide. Do not use cracked software or key generators, which often contain malware.
Store licence keys and invoices in a safe place, so you can prove ownership in case of an audit by the software publisher.
Enable two-factor authentication on your publisher accounts, such as your Microsoft, Autodesk or Adobe account.

Business continuity

We keep backups of our website and key business data and have a plan to restore our services after a disruption. Licence keys and invoices remain available in your customer account and by email, so you can continue to use your software even if our website is temporarily unavailable.

Security incidents

If we detect a security incident, we follow a clear process:

contain the incident and secure affected systems;
investigate the cause and the data involved;
notify the competent data protection authorities and affected customers within the deadlines set by the applicable law, for example within 72 hours under the GDPR;
fix the cause and take measures to prevent it from happening again;
document the incident and the lessons learned.

Report a vulnerability

Found a security issue on our website or in one of our systems? We appreciate responsible disclosure. Please email info@tresbizz.com with the subject "Security report" and include:

a description of the issue and where you found it;
the steps to reproduce it;
the possible impact;
how we can contact you.

Please give us reasonable time to fix the issue before sharing details publicly. Do not access, change or delete data that is not yours, do not disrupt our services, do not use social engineering or physical attacks and do not test against our customers' systems. If you act in good faith and follow these rules, we will not take legal action against you. We will confirm receipt, keep you informed and thank you for your help.

Questions

For questions about security, or if you need security information for your own supplier assessment, contact us at info@tresbizz.com.