SECURITY POSTURE
Named controls, with the limits stated.
These are the controls in the software itself, not a list of intentions. Every one says what it does and where its protection stops — because a control described without its boundary is a promise, not a control.
CONTROL CONSOLE
Four controls, each with its own boundary.
Known sensitive fields are replaced before anything is sent for analysis.
Issue and event payloads are walked recursively and any key matching the sensitive-key list is replaced with [REDACTED]. The list covers password, passwd, token, access_token, refresh_token, authorization, cookie, set-cookie, secret, client_secret, api_key, apikey, private_key, session, jwt, credit_card, card_number, cvv, and phone.
Scope: Matching is by key name, not by value inspection. Sensitive data placed in an unrecognised field or inside a free-text message is not detected.
CONTROL INVENTORY
Everything currently implemented.
Each row is a control that exists in the running software today, not one on a roadmap.
- Sensitive-field redaction
- Recursive key-based redaction applied to issue and event payloads before analysis.
- Encrypted integration tokens
- AES-256-CBC encryption of stored error-tracker tokens; the encrypted field is stripped on serialisation.
- JWT authentication
- Signed session tokens verified by a Passport JWT strategy and an auth guard.
- TOTP two-factor
- Optional time-based one-time codes with a one-step verification window.
- Passkeys (WebAuthn)
- Registration and authentication through the SimpleWebAuthn server library.
- Role-based route guards
- A roles decorator and guard restrict privileged endpoints.
- Global rate limit
- Throttling configured at 100 requests per 60 seconds.
- Approval-gated fixes with backups
- Approval status, approver, timestamps, and file backups are stored with each proposed change.
- Isolated deployment
- Application, database, and queue run as separate services, so a compromise of one is not a compromise of the rest.
What this page does not claimThere is no certification or audit report behind these controls. This page describes what the software does. Availability and breach-response commitments, where you need them in writing, live in a service agreement rather than on a marketing page.
KNOW WHAT PROTECTS YOU
Controls this specific are easier to trust than a certification badge.
Every control above is in the software we operate for you. Read what it does, and hold us to it.
- Sensitive fields redacted before analysis
- Integration tokens encrypted with AES-256-CBC
- Approval, approver, and backups stored with every change