Security practices

We aim for OWASP ASVS level 2. We describe only controls that are in place today. We will add independent testing and certifications to this page only once they are complete.

• Connections use TLS, and HTTP Strict Transport Security tells browsers to use HTTPS only.
• A strict Content Security Policy with a new nonce on every request blocks injected scripts. The site cannot be framed by other sites.
• Content from our editors is stored as structured blocks, never as HTML, and links are limited to safe targets.
• Fonts are served from our own server, so no third party sees your visit.

• Accounts are by invitation only; nobody can register themselves.
• Staff must use multi-factor authentication in every session, with passkeys or an authenticator app. Idle staff sessions end automatically.
• Repeated failed sign-ins lock the account for a growing period, and we send login alerts.
• Access is role-based and denied by default. Every action is checked against a policy, and client data is scoped to the client’s organisation.
• Changes to roles need a super admin who has recently confirmed with a passkey.

• Sensitive fields, such as phone numbers, are encrypted with AES-256-GCM before they are stored.
• Application logs redact personal data.
• An append-only, hash-chained audit log records sign-ins, denied actions and changes, so the history cannot be rewritten without detection.
• Uploaded files are checked by their content, size-limited and scanned for viruses before use. Storage is private; only clean images are made public.

• Dependencies are pinned to exact versions and checked for known vulnerabilities on every change.
• Container images run without root rights and are scanned before release.
• Automated checks stop secrets from being committed to our code.