28. Security & Offboarding

Your BPMN Central instance runs on your own database and storage, inside BPMN Central's shared infrastructure. Five things keep it safe. They take ten minutes, and they matter most on the day someone leaves your company.

1. The account owns the instance

Whoever can log in to the BPMN Central account (on www.bpmncentral.com) that created your subscription owns this instance. Keep that account on a shared company mailbox: logins are confirmed by an emailed code, so a departed employee cannot get in. Ownership transfer is a support request from that account.

2. Two IP addresses

• Manager IP — allowed on your database firewall only while you provision; remove it afterwards. It can only check that a connection works and whether the database is empty.
• Instance IP — the address this instance connects to your database from. Keep it allowed while the subscription runs; remove it when the subscription ends.

Both addresses are printed on your dashboard when the instance is provisioned. The instance IP is shared by every BPMN Central instance: it identifies BPMN Central, not you.

3. Connectors: API keys, not IP allowlists

HTTP connectors call your APIs from the shared instance IP. A firewall rule that allows "the BPMN Central IP" therefore allows every customer. Put an API key or token in the connector's headers, or use a secret URL the way Slack incoming webhooks do. The Connectors page carries a reminder on every connector; whether it is really protected is yours to check.

4. Nobody can point an instance at your data

A new instance is only ever provisioned onto an empty database and an empty container, and every database connection verifies your server's TLS certificate against its hostname. Even someone holding your credentials cannot run an instance against your data unless they can also reach your database directly.

5. When someone leaves

1. Rotate the database password and the storage account key on your dashboard (Change DB / storage). The instance restarts with the new values; your admin login does not change.
2. Rotate the API keys and tokens of every service your connectors call, and of every client of your REST API (Admin → API Keys).
3. Review the firewall allowlists on your database and your internal APIs.
4. Change the BPMN Central account password if the person knew it, and confirm the account uses a company mailbox.

Full guide: www.bpmncentral.com/security