Security and hosting, stated plainly

Project data is commercial data. Here is what protects it today, and what is planned, without the fine print.

Sign-in

E-mail and password hashed with Argon2id, account lockout after repeated failures, and optional two-factor codes (TOTP). Single sign-on with OIDC and SAML is planned.

Sessions

HttpOnly, SameSite cookies and sessions that expire. A device list with remote sign-out is planned.

Access

Workspace roles (owner, PMO, PM, member, viewer) and project membership decide what each person can see and change.

Tenant isolation

Every record carries its workspace, and every query is filtered by it. PostgreSQL row-level security is planned as a second line of defence.

Audit trail

Every change is recorded with who made it and what changed, and most changes can be undone.

Encryption

TLS in transit. Encryption at rest and field-level encryption of secrets are part of the production design.

Backups

The production design keeps daily backups with point-in-time recovery for 35 days, in the same region, with a monthly restore drill.

Imports

Uploaded files are size-limited and parsed with safe parsers before anything reaches your data.

Cloud hosting, your region

Critova is cloud-hosted on a portable stack, encrypted in transit and at rest. The production regions are being set up; ask us for their current status before you plan a rollout.

Data regions: A choice of hosting region in the US, EU, Middle East and Asia-Pacific is planned, so each organisation can keep its data where its policies require.
Dedicated database: Enterprise customers will be able to run on their own database, or in a private deployment, with the same code (planned).
Privacy: Designed with GDPR-style privacy principles: full data export at any time, deletion on request, and a record of who changed what.
Certifications: ISO/IEC 27001 is on the first-year roadmap and SOC 2 Type II after it. We do not hold them yet.

Two mirrored streams of bars meeting at a secure vault

Need a security questionnaire answered?

Send it to us with your procurement timeline and we will answer it.

This page is not legal advice. Compliance positions are confirmed with counsel in your jurisdiction before contracts are signed.