Security overview

Access & authentication

• Email + password sign-in with hashed credentials. New accounts are invite-only after the first operator is created.
• Three role layers: platform (instance operators), organization (owner / org admin / member), and workspace (owner / admin / reviewer / viewer).
• Server functions re-validate the session on every request; organization and workspace membership are verified before any read or write.

Data protection

• Encryption in transit via TLS on all endpoints.
• Encryption at rest on the managed database and object storage.
• Signed decisions carry a SHA-256 fingerprint of the analysed documents.
• Anyone can verify a report fingerprint on the public Verify page without accessing workspace data.

AI safety

• Every finding is grounded to a retrieved evidence chunk; ungrounded findings are demoted.
• Agent output is validated against a JSON schema.
• Model choice, prompts and severity thresholds are configurable per workspace.

Operations

• Public health endpoint at /api/public/health.
• Stuck runs older than 15 minutes are marked failed by a scheduled job.
• Audit log records membership changes, criteria edits, auth events and decisions.

Reporting a vulnerability

Send a description and reproduction steps to the security contact configured for this instance. Please do not include real contracts. We aim to acknowledge within two business days.