Security at Sectora

As a security company, we take the protection of your data seriously. We implement industry best practices and undergo regular security assessments to ensure your information is safe.

How We Protect Your Data

Security is built into every layer of our platform

Encryption in Transit

All data is encrypted using TLS 1.3. We enforce HTTPS across all endpoints with HSTS preloading.

Encryption at Rest

Data at rest is encrypted using AES-256. Sensitive fields use additional application-layer encryption.

Passwordless Authentication

We use magic links and passkeys for authentication. No passwords means no password breaches.

Multi-Factor Authentication

Optional TOTP-based MFA for additional account security. WebAuthn/passkey support for phishing-resistant auth.

Role-Based Access Control

Granular permissions control who can access what. Audit logs track all access and changes.

Secure Infrastructure

Enterprise-grade cloud infrastructure with automatic security updates. Regular penetration testing and security audits.

Tenant Isolation in Three Independent Layers

Your data shares infrastructure with other customers but is hard-segmented by three independent controls. Any one layer is sufficient to prevent a leak.

Database-enforced isolation

Every customer row carries a tenant identifier; row-level access policies are enforced by the database engine itself. An application bug — even a missing filter clause — cannot bypass this layer.

Per-request scoped transactions

Before any application code runs, the request handler opens a database transaction scoped to the verified caller. The scope ends with the request, so no state can leak across users on the same connection.

Application-level filters

Intentional redundancy: every query that touches customer data carries an explicit tenant filter on top of the database-layer policy. All three layers would have to fail simultaneously for a cross-tenant leak to occur.

Full Audit Trail

Every privileged action — login, MFA change, integration connect or disconnect, secret reveal or rotation, account state change — is recorded with the user, source IP, user agent, affected resource, and timestamp. The audit log is append-only from the application's perspective.

Tenant-Scoped Integrations

Each customer's integration credentials (OAuth tokens, webhook signing keys) are generated fresh per customer and encrypted at rest. Inbound webhooks are verified with HMAC-SHA256 and constant-time comparison. A compromise of one customer's key affects only that customer — never the platform.

Security Practices

We follow industry best practices and continuously improve our security posture. Our team includes security professionals who understand the threats your applications face.

All code changes require peer review

Automated security scanning in CI/CD pipeline

Regular dependency updates and vulnerability patching

Incident response plan with 24-hour SLA

Annual third-party security audits

Audit log of every privileged action with user, IP, and timestamp

Bug bounty program for responsible disclosure

SOC 2 Type II certification (in progress)

Security Questions?

If you have security concerns or want to report a vulnerability, please contact our security team.

security@sectora.io