Trust centre

Security controls

A defence-in-depth baseline aligned to OWASP ASVS Level 2, with explicit controls for multi-tenant data and customer file exchange.

Security posture: production baseline ready

Automated checks cover tenant boundaries, dependency vulnerabilities, secrets, static analysis, container images and infrastructure. Independent penetration testing remains a release gate for an external production service.

Controls enabled

Strong authentication

Configured

Passkeys, multi-factor authentication, session rotation and fresh-session checks

Tenant isolation

Enforced

Server authorisation plus forced PostgreSQL row-level security on tenant data

Encryption

Enforced

TLS in transit, cloud encryption at rest and AES-256-GCM for integration credentials

Secure uploads

Configured

Presigned quarantine uploads, type allowlists, malware scanning and signed downloads

Immutable audit trail

Enforced

Privileged actions, overrides, support grants, exports and integration activity

API protection

Enforced

Scoped keys, keyed hashes, idempotency, request limits and signed webhooks

Production release gates

Cross-tenant access suite passes

Database restore tested

Malware scanner healthy

High-severity dependency audit clean

Signed images and SBOM produced

Independent penetration test resolved

SSO and SCIM tested for enterprise

Incident and breach runbooks exercised