Security and compliance
How the platform is protected, and what can be demonstrated.
This page is being prepared. What follows is a draft, not the final text — do not rely on it for a legal or contractual decision.
Key points
- One identity source — Keycloak — instead of a password per app.
- Each organisation lives in its own directory branch and cannot see the others.
- Every permission change records who did it, what changed and when.
1Authentication
Sign-in is centralised through Keycloak over OIDC; passwords, sessions and multi-factor are handled by the identity provider. The individual apps hold no passwords of their own.
2Tenant isolation
Each organisation gets its own LDAP branch with access rules that block cross-tenant reads. Users in one workspace cannot look up users in another.
3Operations
There are scheduled backups, an audit trail for every role and permission change, and a rehearsed incident procedure. The authorisation log records the actor, the action and the timestamp.
4Reporting a vulnerability
If you find a vulnerability, report it privately to the contact address below before disclosing it. We acknowledge receipt and keep the reporter informed as the fix progresses.
Related pages