Security is not something BP Exch treats as a footnote. Your login and account are protected by multiple layers of security at all times — here's exactly what we do and what you can do to make your BP Exch login as secure as possible.
256-Bit SSL on Every Login
Every time you log into BP Exch, the connection between your device and our servers is encrypted using 256-bit SSL — the same standard used by banks. Your email, password, and session token are never transmitted in plain text.
Failed Login Attempt Monitoring
Our systems monitor for repeated failed login attempts from the same IP address. After a threshold of failed attempts, the account is temporarily locked and a security alert is sent to your registered email. This prevents brute-force attacks on your password.
New Device Login Alerts
If your BP Exch account is accessed from a device or location we haven't seen before, you will receive an email notification confirming the login. If the login wasn't you, the email contains a link to immediately lock your account and contact support.
Automatic Session Expiry
Your session automatically expires after a period of inactivity. This means that if you leave BP Exch open on a shared device and forget to log out, the session will expire on its own — preventing anyone else from accessing your account.
No Password Storage in Plain Text
BP Exch never stores your password in readable form. We use cryptographic hashing (bcrypt) to store an irreversible representation of your password. Even if our database were compromised, your actual password could not be extracted from it.
