Security
Built so your IT team can check it.
Five mechanisms, each one in the code and under test. What is not built is not on this page.
What protects what
Five mechanisms
Each one answers a question an IT lead asks first.
-
Your folder is yours alone
One folder per company, in mode 0700 and owned by the service user. The operating system refuses a read from any other company, even if the application got something wrong.
-
Secrets are stored encrypted and listed by name
A company secret is encrypted in the database and decrypted only inside the process. No endpoint returns the value. The list shows names, and the interface shows Value hidden.
-
Every tool the agent runs lands in a hash chain
Each run writes a row: a hash of the arguments, whether it finished, how long it took and the hash of the row before it. Edit or delete a row and the chain breaks. The raw arguments are never stored.
-
Roles follow your org chart
A company role from owner to viewer, and a seat in each department. Whoever manages a parent department manages its children. Sharing a file adds access and never removes it.
-
A backup every day
The database is dumped every day and kept for two weeks. The vault is snapshotted with hard links, so a day on disk costs only what changed.
Before you sign
Bring the person who is going to say no.
An IT lead gets the mechanism, not an adjective. If something you need is missing, we say so in the first conversation.