Security
Users · RBAC · field-level audit
Implemented industry standard security controls.
How to read this
What ships in the product.
Everything below is in the system. The same record-level rules apply to dashboards — a widget does not show a project the user cannot open.
The controls
Authentication, integrity, configuration hygiene.
Authentication and access
- JWT sessions, bcrypt passwords
- Tokens for the session. Passwords hashed with bcrypt. Credentials are not stored in the clear.
- Brute-force lockout
- Repeated failed logins lock the account for 15 minutes. Guessing is not a strategy.
- Self-registration locked down
- Open sign-up is off by default. An organisation is invited in, not scraped from the internet.
- Roles and security groups
- Admin, manager, viewer — plus security groups with per-module permissions. Ball-in-Court rides on the group.
- Record-level visibility
- View Groups on Projects and Programmes. Child-record visibility gates. Dashboard widgets honour the same rules — a chart does not leak a record the user cannot open.
- API keys
- Scoped keys, restriction to allowed apps, optional expiry. Integrations get what they need, not a master password.
Integrity and accountability
- Audit log on every mutation
- Before and after snapshots. Exports and logins are logged too. The trail is not optional furniture.
- Diff analysis — what changed?
- The audit output is a field-by-field diff, not two raw snapshots for a specialist to compare. What it was. What it is. Who. When.
- Workflow-locked fields
- Once a step is complete, those fields lock. The API refuses the write — HTTP 423 — so a finished record cannot be quietly edited.
- Signed webhooks
- Outbound payloads are HMAC-SHA256 signed. Envelopes are thin: no field data leaves the system on the wire.
Configuration hygiene
- Secrets in the environment
- Credentials live in environment variables. None in the codebase.
- Hardening with regression tests
- A dedicated security-hardening pass, with tests so the controls stay put when the product moves.
Audit output
Diff analysis. The question is: what changed?
The log is not a pile of snapshots. It is a field-level diff — what it was, what it is — plus who and when. Exports and logins sit on the same trail. Made simple enough that a project controller can read it without a forensics exercise.
Access is part of ease of use. Users see the records they are allowed to see — in the business process, in search, on the dashboard. Administrators set roles and security groups in the product. More on trust on the product tour and on the configuration toolkit.
See it running against your own programme data.
Not a canned demo environment — your business processes, your data.