Home › Security
Trust
Security.
Governance software is only worth as much as the guarantees underneath it. These are the controls in place today, not aspirations.
Tenant & access control
- Tenant isolation enforced inside the database with row-level security on every tenant-scoped table, applied even to table owners
- Role-scoped visibility: officers see their work, leaders see their team's down the reporting chain, managers see all
- All writes pass through governed functions, so no screen can bypass a business rule
- Least-privilege application role; multi-factor authentication on privileged administrative accounts
Data protection
- TLS 1.3 on every public endpoint; database connections over SSL
- Encrypted at rest with volume-level encryption, and AES-256 on backup storage
- No public database port; administrative access only over an authenticated tunnel
- Network segmentation between the application, database and automation hosts
Evidence & recovery
- Complete audit trail: every status change timestamped, attributed to a named person, with mandatory reasons on rejection and cancellation
- Morning self-checks: the system verifies all four of its security invariants every day, and alerts on any drift
- Cross-region encrypted backups plus daily volume snapshots, held in a separate region, delete-protected, covering data and application layer, and restore-tested
- A full database dump taken before every schema migration
On certification: BSLR is built against the ISO 27001 control areas: access control, cryptography, operations security and communications security. We are not certified, and we will not imply otherwise. Ask us and we will tell you precisely which controls are in place and which are still on the roadmap.
Each of these is evidenced, not asserted.
The evidence register states how every control above is known to be in place: a test result, a measured number, or a logged decision.