TRUST VERIFIABLE, NOT VIBES
Security you can
put in a questionnaire.
You're trusting us with incident records, training files and workers' emergency information. Here is exactly how that data is protected — including, at the bottom, what we haven't built yet. Ask your IT person to grill us; we like those calls.
01 IDENTITY & ACCESS
| Password policy | 12+ characters with complexity, bcrypt-hashed at rest |
| Credential stuffing | Constant-time login — response timing never reveals whether an account exists |
| Brute force | Rate limiting on all authentication routes |
| Session control | Password changes invalidate every outstanding token instantly |
| Single sign-on | Generic OIDC against your IdP (Entra ID, Okta, Google Workspace); signatures verified against the provider JWKS; no just-in-time provisioning — unknown identities are rejected |
| API keys | Shown once, stored only as SHA-256 hashes; read and integration tiers; instantly revocable |
| Role & site scoping | Five-role RBAC plus optional per-site access restriction with membership expiry |
02 TENANT ISOLATION
| Data isolation | Every tenant table is company-scoped from the authenticated token — never from client input; cross-tenant requests return 404, revealing nothing |
| Continuous verification | Isolation is covered by 1,300+ automated tests run on every change, including deliberate cross-company access attempts in every module |
03 DATA PROTECTION
| In transit | TLS on all endpoints, HSTS in production |
| At rest | Encrypted managed database volumes; offline device caches are AES-GCM encrypted and wiped on logout |
| Access & erasure | One-call personal data export (DSAR) and right-to-erasure that anonymizes people while lawfully retaining safety records (GDPR Art. 17(3)(b)) |
| Medical data | Medical alerts visible to elevated roles only; every access individually logged |
04 AUDITABILITY
| Mutation audit trail | Every authenticated write in every module logged: who, role, route, status, IP, user agent — registered globally so no module can be missed |
| Request tracing | Every request carries a correlation ID from your bug report to our logs |
| Monitoring | Hourly production smoke checks including a real browser login flow; health checks verify database connectivity |
05 APPLICATION SECURITY
| Input validation | Schema validation on every request body |
| Injection | Parameterized queries exclusively — no string-built SQL |
| Headers | nosniff, frame-deny, referrer and permissions policies on every response |
| Webhooks | Outbound payloads HMAC-SHA256 signed so receivers can verify authenticity |
| Supply chain | Deliberately small dependency tree — no ORM, no framework sprawl — fewer places for someone else's vulnerability to become yours |
HONESTY KNOWN GAPS, PUBLISHED
What we haven't built yet.
Vendors who claim perfection are hiding something. Our current roadmap, in priority order:
- Automated dependency scanning in CI (small dependency tree mitigates today).
- Error-tracking service integration (structured logging with a single integration seam is in place).
- MFA on password logins — mitigated today by SSO support, where your IdP enforces MFA, and a 12-character minimum policy.
- Formal ISO 27001 / SOC 2 policy pack — the technical control evidence above is the foundation; the paperwork program comes with scale.
- Scheduled restore drills on top of managed database backups.
Security questionnaire to fill? Send it over — security@vigilhse.com.