How we protect your account and your workspace

Multi-factor authentication

Every account created with an email address and password must set up an authenticator app (TOTP) from its second sign-in onward; there is no way to opt out, and no support ticket or setting turns it off. (The very first sign-in after creating the account, and that one only, completes without it; every sign-in after that is challenged for it.) This is enforced by our identity provider (Amazon Cognito), not by this application's own code, so it applies before your account can reach any workspace data.

If you sign in with Google, Microsoft or LinkedIn instead, multi-factor authentication is between you and that provider. We cannot see, enforce or verify whether MFA is turned on for a social sign-in; it depends entirely on your own account settings with that provider. If that matters to you, turn on MFA with your Google, Microsoft or LinkedIn account directly, or use an email and password account instead, where it is mandatory.

If you lose access to your authenticator app, self-service recovery is not available yet: a super admin (the only role with Cognito access) clears the lost device for your account from our side, and you are asked to set up a new one the next time you sign in.

Where your data is stored

Workspace data is hosted in Amazon Web Services' Asia Pacific (Sydney) region (ap-southeast-2). We do not currently offer a choice of region. This describes the infrastructure as built; nothing is deployed to a live AWS account yet, so this is not yet where your data actually lives.

Encryption

Every connection between your browser and our services uses TLS (HTTPS); there is no unencrypted path to sign in, load a workspace, or export a file. Our managed database (Aurora PostgreSQL) is configured for encryption at rest and requires TLS on every database connection. As above, this describes the built infrastructure; it takes effect once deployed.

Uploaded files and malware scanning

File attachments (for example, evidence you attach to a control or a risk) are not part of the product yet. When file uploads are introduced, every uploaded file will be scanned before it is ever made available for anyone to download, and a file that cannot be confirmed clean will stay blocked rather than be served. This page will be updated once that capability ships.

Audit log

Actions that change your workspace's data or membership are recorded in an append-only audit log: who did what, and when. Nothing is written to it selectively, so there is no write path that skips being logged. A screen for workspace admins to read their own workspace's log is planned but not built yet; today the log is recorded, not yet visible in the app.

Workspace isolation

Each workspace's data is kept apart from every other workspace in two separate ways: in how the application queries the database, and by row-level security in the database itself. A defect in one layer is not enough on its own to expose another workspace's data.

Questions

If you have a specific security question about this product, email Zenith Consulting Services at support@zenithconsultingservices.com.au.