04Security

What we can state plainly

Which controls and boundaries can be stated truthfully today?

No certifications are claimed. Each line below is a property of the system as it is built today — checkable, not asserted.

Control, evidence, limitation

Each area names the claims it covers, what stands behind them, and what it does not extend to.

Every entry below carries all three. A control without a limitation is a claim.

Session handling

Server-managed sessionsTokens live in HttpOnly cookies set by the server. Browser JavaScript never reads them.

Evidence: Tokens are set by the server as HttpOnly cookies; page scripts cannot read them.
Not claimed: This describes how a session is held in the browser. It is not a statement about transport or storage encryption.

Authorization and isolation

Backend authorizationEvery decision is re-derived from the backend on each request. The interface never grants what the API would refuse.
Organization isolationRecords are scoped to one organization, and a record outside yours is answered the same way as one that does not exist.

Evidence: Permission is decided fresh on every request, and a record outside your organization answers exactly as one that does not exist.
Not claimed: The interface never grants what the API refuses. It does not audit what an authorised person then chooses to do.

Delivery gates

Dependency audit gateA high-severity advisory in the dependency tree fails the build before anything ships.
CI quality gatesTypecheck, lint, the full test suite and a production build run on every change from a clean runner.

Evidence: A high-severity advisory fails the build, and typecheck, lint, the full suite and a production build run on every change from a clean runner.
Not claimed: These are gates on what ships. They are not a penetration test or a third-party review, and neither has taken place.

Allocation governance

Reviewed allocationsA proposal is not an assignment. The owning department decides, and the decision is recorded.

Evidence: A proposal is not an assignment; the owning department decides and the decision is recorded.
Not claimed: The system records who decided. It does not judge whether the decision was the right one.

Where the product stops and the organization starts

Some of this the product decides. The rest is yours, and saying so is part of the boundary.

The product enforces

What each person is allowed to do, re-checked on every request.
That a record outside your organization is indistinguishable from one that does not exist.
That an allocation exists only after a named department manager accepted it.

Your organization decides

Who is granted which role, and who is appointed to a department.
Whether a rejection is revisited, and on what grounds.
How the organization runs everything Potriv holds no record of.

Current scope

Everything above is enforced today. These are the things Potriv does not do, listed so the boundary is as clear as the controls.

No certification of any kind — SOC 2, ISO 27001 and the rest are neither held nor claimed.
No third-party audit or penetration test has been performed.
No uptime, availability or service-level guarantee is offered.
No claim is made about encryption at rest, backups, retention or disaster recovery.
No single sign-on, directory sync or exported audit trail exists today.

That is the whole plan.

Five chapters: the problem, what the product holds, how a requirement becomes an allocation, who decides, and what is enforced. The next step is bounded on purpose — one department and one project.

Create your workspace Sign in Back to the overview