- Home
- Security
Platform and security · End-to-end layer
Isolation is enforced by the database, not by a condition in application code
Multi-tenancy is built on row-level security in PostgreSQL: data boundaries are drawn at the database level and apply to every query. On top of that: roles assembled from an operation catalog, classification levels with personal clearances, and an audit log. Everything runs inside your perimeter - there is nowhere for data to leak.
Access model
Four system roles plus a builder for your own
Permissions are not scattered across settings. System roles cover the typical positions; for everything else, a role is assembled from the catalog - operation by operation.
| Role | Who it is | What is allowed |
|---|---|---|
| owner | Organization owner | Everything, including organization and license management |
| admin | Administrator | Users and roles, the audit log, system settings |
| manager | Staff member | Working with documents, deals, and the warehouse |
| viewer | Observer | Read-only - no changes allowed |
Custom role builder. When the four standard roles are not enough, a role is assembled from a «role × entity × operation» catalog: every operation is granted by name, so when an auditor asks «where did this employee get this permission», there is always an exact answer.
Classification levels and ACLs
A document is visible to those cleared for it, not to whoever found the link
Five confidentiality classification levels and personal employee clearances. For targeted exceptions - an access control list on the individual document: subject, permission, effect.
adminEdit cardAllowmanagerRead cardAllowmanagerDownload fileDenyDocument access list layout. «Deny overrides Allow»: if a permission is granted by a role and denied on the document at the same time, the denial wins.
The classification is on the document, the clearance is on the employee
Every document is assigned a classification level from 0 to 4; every employee holds a personal clearance. Access is determined by matching the two - not by the folder the file happens to sit in: moving a document does not open it to outsiders.
Full-text search obeys the same rules: the index returns only what the classification level and clearance allow. A confidential document never surfaces in results «by accident» - not as a card, not as a text fragment.
ACLs work on top of classification levels: the subject of an entry can be a role, a department, or an individual user; the permission is a specific operation; the effect is «Allow» or «Deny».
Audit log
An event stream that cannot be rewritten after the fact
Who opened, who changed, who approved, who downloaded - every significant action stays in the audit log.
- Append-only. The log is an immutable stream: entries are appended; retroactive edits and deletions are ruled out by the data model itself.
- SHA-256 for every file version. The checksum is recorded when the version is written; content substitution is detected by hash comparison.
- A separate permission to read the log. Audit access is granted to the security administrator as a permission of its own: system administration and oversight are kept apart.
Infrastructure
Directory, backups, and updates - under your IT department's procedures
LDAP / Active Directory
Accounts, attributes, and lockouts sync from your directory. A dismissed employee loses KASKAD access the moment they are blocked in the domain - no manual shadow bookkeeping.
Backups
Standard PostgreSQL tooling plus a copy of the file store. The restore procedure is described in the operations documentation and verified during acceptance.
Updates without a maintenance window
An update is a package: new service versions and automatic database migrations. Services run under systemd; updates are installed on a business day, with no weekend window.
Pre-release testing
Every release passes the live environment before it reaches the customer
A build ships to customers only after a full run of end-to-end scenarios on a working system. Security mechanisms are tested harder than the rest of the code.
Security is tested by trying to break it. RLS, classification levels, and the audit log have their own set of scenarios: the stand deliberately tries to read another organization's data and to backdate an audit log entry - both attempts must be rejected and leave a trace in the audit log.
Send us your security team's questions
We will show RLS, classification levels, and the audit log in a live environment, and hand over the documentation set, including an FAQ for IT and security teams. The demo takes 40 minutes.