Security
Built for people who audit security.
The platform holds evidence about an institution's security controls, so we treat it accordingly. Here's what is in place today.
Controls
6 of 6 on
- Two-factor sign-inTOTP + recovery codes
- Single sign-onVerified domains only
- Organisation isolationAttacked in tests
- Malware scan on uploadEvery file
- SHA-256 fingerprintsEvidence and reports
- Append-only activity logBefore and after
Access
- Email verification before first sign-in; two-factor authentication (TOTP) with recovery codes.
- Passwords of at least 12 characters, checked against common and breached passwords (only a partial hash leaves our servers), stored with a slow, salted hash.
- Single sign-on with Microsoft Entra ID, Google Workspace or Okta, limited to verified domains.
- Sessions in HTTP-only, same-site cookies; no tokens stored in the browser. They end after hours without activity, and unsaved work is kept until you sign in again.
- Role-based permissions: owner, admin, lead auditor, auditor, reviewer, viewer, auditee.
Isolation
- Every request is checked against the caller's organisation; other organisations' data answers as not found.
- Auditees only reach the evidence requests and findings assigned to them, through a separate portal.
- Automated tests attempt cross-organisation access on every endpoint before each release.
Evidence
- Uploads are size-limited, type-checked and fingerprinted (SHA-256) on arrival, and scanned for malware with ClamAV wherever it's switched on, as on self-hosted deployments.
- Files are stored privately under random names and only served as downloads, never rendered in the browser.
- Issued reports are stored with a fingerprint, so a copy can be checked against the original.
Accountability
- An append-only activity log records who changed what, with the value before and after.
- Maker–checker review: an area can't be approved by the person who submitted it.
- Spreadsheet exports are protected against formula injection.
Hosting and data residency
The hosted service runs in Western Europe: the application and database on Railway, files and separate daily backups in private Cloudflare R2 storage, with encrypted connections throughout and monitoring around the clock. Institutions that need data kept in Ghana, or on their own servers, can arrange an in-country or self-hosted deployment.