Secure by architecture.

Implemented controls

Password storage

PBKDF2-HMAC-SHA256, 100,000 iterations, per-user salt, constant-time comparison.

src/vailidator/auth/password.py

Session tokens

HMAC-signed, peppered with SESSION_SECRET, eight-hour lifetime, cookie-first.

src/vailidator/auth/service.py

API keys

vrf_<prefix>_<secret>, stored as a PBKDF2 hash, scoped to one organization.

src/vailidator/auth/

Response headers

X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy.

src/vailidator/security/http_headers.py

Content Security Policy

default-src 'self', object-src 'none', frame-ancestors 'none', and no remote script. Inline styles are allowed, and the module records why.

src/vailidator/security/http_headers.py

HSTS

One year with includeSubDomains, emitted only when the deployment is HTTPS, so local http development is never forced onto https.

src/vailidator/security/http_headers.py

Rate limiting

Sliding window, in-memory, per-IP and per-user, env-tunable. The open local-first tier is deliberately not limited.

src/vailidator/security/rate_limit.py

Request protection

A correlation id per request, a request-body size limit, and a 500 handler that returns a request id rather than a traceback.

src/vailidator/security/request_guard.py

Environment validation

Required production configuration is checked at startup and reported without ever reading or echoing a secret value: advisory in development, errors an operator can gate on in production.

src/vailidator/security/env_validation.py

Tenancy

Organization scope is derived from the authenticated session and never accepted from the request body, so a cross-tenant read is not expressible.

src/vailidator/cc/

Roles

ADMIN > ANALYST > VIEWER, canonicalised in one place, with explicit membership always winning.

src/vailidator/orgs/

Supply chain

A hash-pinned dependency lock, SHA-pinned GitHub Actions, a secret scan in CI, and checkout without persisted credentials.

scripts/check_workflow_pins.py

Architectural properties

Not controls anyone operates. They hold, or the design has changed.

No telemetry

There is no endpoint to report to, so there is nothing to switch off.

BY CONSTRUCTION

Offline verification

Evidence verifies from the files alone, with no network and no key held by us.

BY CONSTRUCTION

Determinism

The same inputs produce the same evidence identifiers. A result that cannot be reproduced is a defect, not a variation.

BY CONSTRUCTION

Fail closed

A capability that cannot answer reports that it cannot. Missing input becomes an explicit unknown; it never becomes a pass.

BY CONSTRUCTION

No licence check

No key, no activation, no expiry and no phone-home, so an air-gapped deployment cannot be locked out and equally cannot be metered.

BY CONSTRUCTION

Not implemented, and not certified

SOC 2

Not held. No report exists, and this page will name one only when it does.

NOT CLAIMED

ISO/IEC 27001 or 42001 certification

Not held. The product reads evidence against ISO/IEC 42001 as a policy pack; that is alignment data, not a certificate, and it certifies nobody.

NOT CLAIMED

External penetration test

None is published. Where one is performed it will be named here with its date and scope.

NOT CLAIMED

Classified-environment accreditation

Not claimed. Air-gap compatibility is a property of the architecture; accreditation is an assessment somebody else performs, on a specific deployment.

NOT CLAIMED

SSO, OIDC and OAuth

Not implemented. sso is a catalog flag with no enforcement point, and there is no hosted identity integration of any kind.

NOT CLAIMED

Multi-factor authentication

Not implemented.

NOT CLAIMED

Cryptographic signatures

Evidence is content-addressed and tamper-evident. It is not signed, and this site does not describe it as though it were.

NOT CLAIMED