Security Policy

1. Our commitment

We take the security of your data seriously. This page describes the technical and organisational measures built into CERBEATH (the "Platform") to protect it, and how to report a concern. No system can guarantee absolute security, but we design and operate the Platform to reduce risk at every layer described below.

2. Tenant isolation

The Platform hosts many organisations on shared infrastructure, but each tenant's data is isolated from every other tenant's at the database level using PostgreSQL Row Level Security policies, not merely application-level filtering. Every tenant-scoped request explicitly sets which tenant it is acting for before any data is read or written, so one organisation's users, licenses, and enforcement records are never visible to another.

3. Access control

Access within a tenant's own data is further restricted by role. Platform areas are grouped into sections (Licenses, Enforcement, Users, Administration, and so on), with per-role read/write/delete/export grants and per-user overrides where needed. Every privileged action is checked against the acting user's effective access before it is permitted.

4. Authentication

• Passwords are never stored in plain text - they are stored using a salted, one-way cryptographic hash (bcrypt) with an additional server-side pepper, so we cannot see or recover your actual password, even internally.
• Login and password-reset endpoints are rate-limited to slow down automated guessing attempts.
• Sessions use short-lived, asymmetrically-signed (RS256) JWT access tokens paired with revocable refresh tokens; when you log out, your session is explicitly revoked rather than simply discarded client-side.
• Accounts are temporarily locked out after repeated failed login attempts.
• A forced password-change flow can be triggered by an administrator, for example after issuing a temporary password, and blocks access to the rest of the Platform until completed.

5. Transport & response security

All traffic between your device and the Platform is encrypted in transit using HTTPS/TLS (with HTTP Strict Transport Security enforced in production). Every response also carries X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a restrictive Permissions-Policy header.

6. Application security

• All database access goes through parameterised PostgreSQL functions/procedures - user input is never concatenated directly into a database query.
• Cross-origin requests are only permitted from the Platform's own configured origin; there is no wildcard CORS policy.
• Machine-to-machine endpoints (such as the background enforcement agent's check-in) authenticate with a constant-time-compared shared secret, separate from user session tokens.

7. Audit trail

Sensitive actions - such as changes to licenses, enforcement policies, permissions, and administrative configuration - are written to an append-only audit log. The database role the application connects as is granted INSERT/SELECT only on this table and explicitly denied UPDATE/DELETE, so entries cannot be altered or removed even if the application itself were compromised.

8. Breach notification

If we become aware of a security incident that is reasonably likely to result in a risk to your personal data, we will investigate promptly and, where required by law, notify affected tenant organisations and/or the relevant regulator without undue delay - including, where applicable, within the 72-hour window required by the GDPR, and in line with the notification duties under POPIA and the CCPA/CPRA.

9. Responsible disclosure

If you believe you have found a security vulnerability in the Platform, please report it responsibly to info@ath.solutions with enough detail for us to reproduce it. Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and address it, and do not access, modify, or delete data that does not belong to you while investigating. We will acknowledge good-faith reports made in accordance with this policy and will not pursue legal action against researchers who follow it.

10. Your role

• Use a strong, unique password for your account and do not share it with anyone.
• Log out of shared or public devices after use.
• Report suspicious activity on your account to your organisation's administrator immediately.

11. Changes

We may update this Security Policy from time to time as the Platform evolves. We will update the "Last updated" date above when we do.

12. Contact

For security reports or questions about this policy, contact info@ath.solutions.