Security

Multi-tenant isolation

Every organization's data is isolated at the database using PostgreSQL Row-Level Security (RLS), enforced (FORCE) on every tenant table. The application connects with a dedicated, non-superuserdatabase role that cannot bypass these policies, and each request runs inside a transaction scoped to the acting organization, user, and role. This prevents one tenant from reading or writing another tenant's data — verified by automated cross-tenant isolation tests.

Access control

• Role-based access control (RBAC): permissions are enforced by a capability model (Employee, Manager, HSE Officer, Org Admin) and further scoped at query time (e.g., managers see their department).
• Least privilege: the runtime database role holds only the DML rights it needs; schema changes and migrations use a separate privileged path.
• No standing administrative back-doors: platform support access to a tenant requires an explicit, time-boxed and fully audited grant that auto-expires and can be revoked instantly. There is no persistent cross-tenant access.

Authentication

• Passwords are never stored in plaintext — only as salted bcrypt hashes.
• Optional single sign-on with Google and Microsoft (OAuth 2.0 / OIDC).
• Sessions are signed; sign-in is protected against cross-site request forgery (CSRF), and open-redirect protections are applied to post-login navigation.

Encryption

• In transit: all traffic is served over HTTPS/TLS with automatically managed certificates. HTTP Strict Transport Security (HSTS) is enabled.
• At rest: database and file storage volumes are encrypted at rest.
• File access: attachments and exports are served via short-lived, pre-signed URLs that expire, and object keys are validated against the requesting tenant to prevent cross-tenant object access.

Auditing & integrity

Security-relevant actions (creation, updates, state changes, permission changes, exports, and administrative actions) are written to an append-only audit log. The application role can insert audit records but cannot update or delete them, providing a tamper-resistant history for accountability and investigations.

Application security

• Server-side input validation on all write paths (schema validation) and output escaping to mitigate injection and cross-site scripting;
• HTTP security headers, including a Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and a restrictive Permissions-Policy;
• Signed-webhook verification for payment events;
• A continuous integration pipeline that runs type checks, linting, and an extensive automated test suite (including security and isolation tests) on every change.

Payments

Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We do not collect, transmit, or store full payment card numbers on our systems.

Infrastructure & availability

The Service runs on Amazon Web Services (AWS). Network access is restricted by security groups, and backing services are not exposed publicly. We maintain health monitoring and perform database backups; recovery objectives depend on your plan and agreement. See our Privacy Policy for the list of sub-processors.

Data retention & deletion

Customer content is retained according to the retention period configured for the organization and deleted or returned on termination, subject to backup rotation and any legal-hold obligations. See the Privacy Policy for details.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email security@hse-reporting-platform.com with details and steps to reproduce. Please act in good faith, avoid privacy violations and service disruption, and give us a reasonable time to remediate before public disclosure. We will not pursue legal action for good-faith research conducted in accordance with this policy.

Incident response

We maintain procedures to detect, investigate, and respond to security incidents. If a personal-data breach affecting you or your organization occurs, we will notify affected Customers without undue delay and in accordance with applicable law and our agreements.

Compliance posture

Our program is designed to align with the GDPR/UK GDPR and industry best practices, and we offer a Data Processing Addendum to Customers who require one. This page describes our current practices and is not a certification. For specific compliance documentation or questions, contact security@hse-reporting-platform.com.