Security Overview

1. Data minimisation

We ingest only the metadata required to produce engineering reports. We do not clone repositories, store source code, store full task descriptions, or store comment bodies beyond the immediate retention needed for the next sync cycle.

2. Encryption

• In transit: TLS 1.2+ for all public endpoints; HSTS enforced.
• At rest: AES-256 for application data and backups.
• Integration tokensare encrypted at the application layer (AES-256, using the deployment's encryption key) before being written to the database, and are never returned to the browser.

3. Access control

• Role-based access control (RBAC) at the workspace level: Owner, Workspace Admin, Manager, Member, and Viewer.
• Server-side permission checks on every request; no client-side authorisation gates.
• Infrastructure access is restricted to named engineers with hardware-key 2FA, audited via SSO.

4. Authentication

• Email + password with bcrypt; rate-limited login.
• SSO via Google, GitHub, GitLab (OAuth 2.0).
• API access via short-lived bearer tokens, scoped per workspace.

5. Audit logging

All privileged actions (workspace settings changes, RBAC mutations, AI report generation, data export) are recorded in an immutable per-workspace audit log accessible to Owners and Workspace Admins.

6. Backups and recovery

• Encrypted daily snapshots, 35-day retention.
• RPO <= 24 hours, RTO <= 4 hours for Tier-1 customers.
• Disaster-recovery exercises run at least annually.

7. Vulnerability management

• Dependency scanning on every CI run (Composer + npm advisories, GitHub Dependabot).
• Penetration test annually by an independent third party (summary available under NDA).
• Responsible disclosure: report security issues to security@enginara.app. We acknowledge within 24 hours.

8. AI provider isolation

Corporate customers may select the self-hosted AI driver (Ollama) so prompts never leave the customer's infrastructure. For cloud AI, only deterministic metric snapshots are sent to the provider; we instruct the provider not to use the data for training.

9. Compliance roadmap

• SOC 2 Type II - audit in progress; expected completion within 12 months.
• GDPR - see Privacy Policy and DPA.
• ISO 27001 - planned after SOC 2.

10. Sub-processors

Listed at enginara.app/legal/sub-processors with notification on any change.

11. Contact

Security issues: security@enginara.app. For general questions during procurement: trust@enginara.app.