Defense in depth, written plainly.

Identity and access

• Email-and-password authentication with verification, password recovery, and optional sign-in links.
• Server-validated sessions and allow-listed callback origins.
• Organization roles for owner, admin, member, and read-only auditor access.
• Multi-factor authentication and a separate controlled session for platform administration.
• Single-use, expiring invitations for privileged administrators.

Tenant and application security

• PostgreSQL row-level security uses the authenticated user identifier and active membership for customer data access.
• Organization isolation and read-only enforcement are covered by database tests.
• Server endpoints choose billing prices from trusted configuration; clients cannot submit Stripe price identifiers.
• Stripe and Resend webhooks require provider signatures and idempotent event processing.
• Browser responses use a restrictive Content Security Policy, HTTPS enforcement, frame denial, MIME-sniffing protection, and limited browser permissions.

Data handling

• Application secrets and provider credentials remain server-side.
• Card data is handled only by Stripe Checkout and the Stripe Customer Portal.
• Policy drafting sends the organization profile, framework, assessment answers and notes, and applicable state-pack requirements to OpenAI. Incident records, training rosters, billing data, and evidence files are not part of that drafting request.
• Operational error collection removes common credentials and personal identifiers and does not retain request bodies, raw headers, or stack traces.

Monitoring and recovery

• Health checks cover database access, Stripe connectivity, required configuration, job freshness, and recent delivery or application failures.
• Active platform administrators receive health-change and first-occurrence production alerts.
• Backup observations and restore drills are append-only. Recovery exercises verify database records and stored evidence separately.
• Organization exports support continuity and public-record retention needs.

Reporting a concern

Email gabe.holcomb@securedroots.com with a concise description and a safe way to reproduce the issue. Do not include live passwords, authentication codes, private keys, or unredacted government records. We will acknowledge the report, preserve relevant evidence, assess impact, and coordinate remediation and notification as appropriate.