Security

Accounts and sign-in

• Passwords are never stored. Veridion stores a salted scrypt hash (N = 2¹⁵, r = 8, p = 1) and compares hashes in constant time.
• Passwords must be at least ten characters. Failed sign-ins return the same message whether or not the account exists.
• Sign-in is rate limited per network address and per account; registration and website enquiries per network address.

Sessions

• After sign-in, the browser holds a signed session token in an HttpOnly, SameSite=Lax cookie that scripts cannot read. Deployments served over HTTPS also mark it Secure; this is a deployment setting, and the server warns at startup in production when it is off.
• Sessions expire after seven days.
• Requests that change data using the cookie must also carry a header set only by the Veridion web client, which protects against cross-site request forgery.
• Programmatic clients send the session token as a bearer credential instead of a cookie.

Workspace isolation and roles

Every company, document, passage, assessment, finding, review and action belongs to exactly one organization, and every query is filtered by the caller's organization. A request for another organization's record is answered as if the record did not exist. This behaviour is covered by the automated test suite.

Within an organization, members have one of five roles. Owners and admins manage members and settings; analysts upload documents and run assessments; reviewers record decisions on findings and actions; viewers can read but not change anything.

Documents

• Only PDF files are accepted, up to 50 MB, and the file signature is checked on upload.
• Storage locations are generated by the server; file names supplied by users are never used as paths.
• Documents are processed by background workers, not in the web request. Encrypted or unreadable files are rejected with a clear error.
• A document that findings cite cannot be deleted, only replaced by a new version, so past assessments remain auditable.

Activity records

Sign-ins, failed sign-ins, uploads, assessment runs, reviews, overrides, exports, applicability decisions, and member and plan changes are written to an append-only audit log that owners and admins can read in the workspace settings.

Web protections

The website and application send headers that prevent content-type sniffing and framing by other sites, restrict the referrer sent to other sites, and disable browser features the product does not use.

What depends on hosting

Encryption in transit requires the deployment to be served over HTTPS, and encryption at rest depends on the database and object storage used. Backups, disaster recovery and business continuity commitments have not yet been established for a production service. We will document the production configuration here before offering one.

Reporting a vulnerability

If you believe you have found a security issue, please tell us through the contact form, choosing “Security report”. Describe the issue and how to reach you, but do not include exploit details until we have replied with a secure channel.

Please do not access data that is not yours, degrade the service, or use social engineering, and give us reasonable time to fix an issue before disclosing it. We do not currently offer a bug bounty, but we will acknowledge your report and keep you informed.