Security and trust
What we do, stated plainly
This page describes the controls actually in place across our products. Where we do not yet hold a certification, we say so rather than implying otherwise.
Controls
How the platform is secured
Authentication
- Passwords hashed with bcrypt, never stored or logged in plaintext
- Sessions carried in HttpOnly, Secure cookies — not in browser-accessible storage
- OAuth sign-in supported where a product needs it
- Session invalidation on password change and sign-out
Authorisation
- Role-based access control enforced in middleware, not duplicated per route
- Organisation and team boundaries applied at the data layer
- Administrative actions separated from ordinary user permissions
Data handling
- TLS in transit for all traffic, terminated at the edge
- Application data in managed document databases with provider-side encryption at rest
- User files in S3-compatible object storage behind time-limited signed URLs
- Exportable on request in a standard format, at any time
Operations
- Centralised logging and error tracking across the portfolio
- Uptime monitoring with a shared incident runbook
- Dependency and security patching on a regular cadence
- Environment secrets held in managed secret storage, never in the repository
Compliance
Where we stand today
Buyers ask this early, so here is the honest position rather than a badge wall.
We do not currently claim SOC 2, ISO 27001, or HIPAA certification. If your procurement process requires one, tell us during the first conversation — we will tell you whether that is something we can commit to on your timeline instead of discovering it at contract stage.
We will complete a security questionnaire, sign a mutual NDA, and negotiate a data processing agreement. Deployment region requirements are handled per engagement and confirmed in writing before signature.
Disclosure
Reporting a vulnerability
If you have found something, we want to hear about it before anyone else does.
- Email security@chanovalabs.com with steps to reproduce
- We acknowledge within two business days
- We will tell you our assessment and a remediation timeline
- We will credit you publicly if you want the credit
Please do not run automated scanning against production, access data that is not yours, or degrade service for other users while testing.
Send us your security questionnaire
We would rather answer it up front than three weeks into a procurement cycle.