Security & controls
What we do today, what’s scheduled, and what’s on the roadmap. Honest claims only — anything marked “live” is enforced in code today; anything else has a date.
Authentication
SHA-256 hashed tokens; JWT sessions; password resets time-boxed to 1 hour and hashed at rest; invitations 7-day single-use.
LiveAuthorisation
Role-based: owner, admin, staff, client, auditor. Per-client login isolation — client sessions are JWT-locked to one client at the query layer (defence in depth).
LiveMulti-tenant isolation
Every read helper accepts a tenantId; default is the session's tenant. Cross-tenant access fails closed. Verified with two-tenant tests in CI.
LiveEncryption — in transit
TLS 1.2+ end to end. HSTS preload via Vercel.
LiveEncryption — at rest
Database: AES-256 on Neon (provider-managed). Signing secrets (DocuSign keys, BYO credentials) re-encrypted application-side with a customer-specific key derived from ENCRYPTION_KEY.
LiveAudit trail
auth_events records every login, signup, password reset, invitation, invite acceptance, invoice generation and invoice payment. Per-entity audit_log records every governance decision and document touch.
LiveData residency
Primary infrastructure in the EU (Neon postgres) and US (Vercel edge). Per-region pinning available on Enterprise on request.
On requestBackups & recovery
Neon provides point-in-time recovery (PITR) up to 7 days on production. Daily logical backups retained 30 days.
LiveGDPR / UK GDPR / UAE PDPL
Cookie consent required first-visit; data export available; data deletion on request via support@governos.co.
LiveSOC 2 Type II
Pre-audit readiness review complete. Type II observation window opens Q3 2026.
In progressISO 27001
Statement of applicability in draft. Targeted certification H1 2027.
RoadmapPenetration testing
Annual third-party pentest committed; first scheduled Q4 2026. CVE monitoring on all dependencies via npm audit + Dependabot.
ScheduledIncident response
Status page at /status. Incidents reported within 24h; remediations within 30d. Subscribe via RSS.
LiveVendor due-diligence packet
Available on request to qualified enterprise prospects. Includes architecture diagram, data-flow map, sub-processor list, encryption details, BCP/DR plan, and the latest internal security review.