Security overview

Security is layered across authentication, authorisation, tenancy isolation, data protection, audit, and organisational controls.

Authentication

• Password + optional MFA (TOTP, WebAuthn, SMS fallback).
• SSO via SAML 2.0 / OIDC (Okta, Entra ID, Google Workspace, Auth0).
• Session timeouts per tenant policy.
• Device fingerprinting flags suspicious logins.
• Breach-checked passwords via HIBP.

Authorisation

• Role-based access control (RBAC) with fine-grained permissions — see RBAC.
• Resource-level scoping: users see records in their scope only.
• Segregation of duties enforced at critical points (e.g. can't approve your own AP batch).

Tenancy isolation

• Per-tenant database schemas + row-level policy where shared.
• All queries tenant-scoped at the application layer; defence in depth with Postgres RLS.
• Backups partitioned per tenant to enable per-tenant restore.

Data protection

• In transit — TLS 1.2+ everywhere.
• At rest — AES-256. Document / attachment storage uses server-side encryption.
• Secrets — app secrets, SSO keys, payment tokens in a KMS; never in logs.
• PII handling — see data protection.

Audit

Every sensitive action writes an immutable audit entry. See audit log.

Compliance

• SOC 2 Type II — annually.
• ISO 27001 — certified.
• GDPR — compliant; DPA available; data residency options (EU, US).
• HIPAA — not a stated fit today; no PHI in the platform.
• PCI DSS — we don't store card data directly; payments are tokenised via processor.

Letters, reports and SIG responses are available on request.

Pen testing

Third-party annual pen test. Findings remediation tracked publicly with SLAs. Exec summary available under NDA.

Vulnerability management

• Dependencies monitored via Snyk / Dependabot; critical CVEs patched in < 48h.
• Container images re-baselined monthly.
• Runtime protection via WAF + rate limiting.

Incident response

24/7 on-call + incident commander. Customer notification within contractual timeline after confirmed data-affecting incident.