Security

What this page is

A plain list of the protections in SupaJack Construct today, and of the ones that are not there yet. If a protection is not on this page, do not assume it exists.

Companies are kept apart

Every company’s records carry that company’s identity. PostgreSQL row-level security enforces the separation inside the database on the core record tables, so a query written for one company cannot return another company’s rows. The application connects to the database as a role without superuser rights.

Passwords and sessions

• Passwords are stored as bcrypt hashes with a work factor of 12, and a password must be at least 8 characters.
• A sign-in lasts 8 hours.
• Changing a password ends every session that was opened before the change.
• Sign-in attempts are limited to 5 a minute from one internet address.

Who can do what

Access is controlled by roles. There are 9 built-in roles and 48 separate permissions, and a company can see and change what each role may do. Sensitive steps use four-eyes approval. For example, the person who works out a payroll run does not post it unless they hold an owner, admin or finance-director role, and a person cannot approve their own HR request.

A record of changes

The audit log records who changed a record, when, from which internet address, and the values before and after. File actions in SupaJack Drive are logged as well. Not every action in the application writes an audit entry.

Uploaded files

Uploads are checked against an allow-list of file types and a size limit before they are stored.

Backups

Every database is dumped each night. Each dump is read back to prove it can be restored, and the backup files are readable only by the server administrator. Dumps are kept for 14 days on the server, and a second copy is pulled to a separate machine and kept for 60 days.

Connections

The site and the application are served over HTTPS. Browsers are told to use HTTPS only (HSTS), not to guess file types, and not to show the site inside another site’s frame.

Not available yet

• Two-step verification (a second sign-in factor).
• Locking an account after repeated failed sign-ins. Sign-in attempts are rate limited, not locked.
• A public API with developer documentation.

Reporting a problem

If you believe you have found a security problem, email us at the address in the footer with what you saw and how to repeat it. Please do not test against another company’s data.