Confidentiality is an architectural requirement.

Users may register a private company workspace with email and password. Owners can invite colleagues, while supplier and verifier access remains role-scoped.

• Reviewed password hashing and database-backed sessions
• Secure HttpOnly session cookies and session revocation
• Two-factor authentication temporarily disabled during the pilot
• Generic recovery responses to reduce account enumeration

Every organisation-owned assessment, inventory item, document, run, report and audit event carries a tenant identifier. Protected queries scope both the resource and the organisation, with role checks repeated on mutation endpoints.

Uploads are restricted by size and file type, stored outside the public web root and identified by SHA-256. Downloads and generated reports require a fresh authorised lookup. Production deployment requires verified email delivery, stronger anti-abuse safeguards, malware scanning, encrypted managed storage and tested retention controls.

Security-relevant and scientific actions create attributable audit events. Calculation runs preserve canonical input hashes and method versions. Software calculation, scientific review and independent verification remain separate states.

This repository is a working application, not a claim of ISO 27001, SOC 2, GDPR certification or an completed penetration test. Before production use, the operator must configure managed PostgreSQL, SMTP, malware scanning, backups, monitoring, regional hosting and legal controls, then complete independent security review.