Security at Bund
Bund verifies who it's talking to, stays inside the limits you set, and keeps a record of every action it takes on a customer's behalf
An agent is only as safe as its permissions.Bund asks before it acts.
Verifies before it acts
Bund confirms identity with an emailed one-time code before it reads an order or changes anything on an account
Stays inside your limits
Actions you mark need the customer to confirm, and refunds above your limit go to a person with the reason
Masks what it shouldn't see
Card numbers are masked before they reach the model, and you can mask emails and phone numbers too
Guardrails in every conversation
Verify before acting
Bund asks for a one-time code by email before it shares order details or changes anything on an account
Explore verificationMask what it shouldn't see
Card numbers are masked as messages arrive, so the model never sees the full number
Explore maskingKeep every action on the record
Approvals, takeovers, configuration changes and MCP calls are written to the audit log with who made them and when
Explore the audit logLocked-down sign-inwith roles and two-factor
Members can sign in with their Google account
Authenticator-app codes on every account
Owner, manager and agent permissions
FAQ
How does Bund verify a customer's identity?
It emails a 6-digit code to the address on the record. The code lasts 10 minutes, and order and account actions stay locked until the customer enters it.
Can we set different rules for different actions?
Yes. You choose which actions are on, which ones need the customer to confirm first, and the refund limit above which Bund hands off to a person.
What does the supervisor check do?
A second check reviews every reply before it is sent. If a reply fails it, the customer gets a short holding message and the conversation is escalated to your team.
What gets written to the audit log?
Approvals, takeovers, configuration and knowledge changes, team and API key changes, and every MCP call, with who made them and when.
Who on my team can change what?
Owners and managers configure the workspace. Agents work conversations, tickets and customers, and see configuration read-only. Every member can turn on two-factor sign-in.
How do I report a vulnerability?
Email security@usebund.com instead of opening a public issue. We acknowledge reports within 3 business days.