Security at Depentra

Our approach

Security is designed in, not bolted on: least-privilege access, defence in depth, and independent verification. Every change ships through a CI pipeline with dependency audits, and every table in our database enforces row-level security so queries can only ever return data belonging to your organisation.

Encryption standards

• All data in transit is encrypted with TLS 1.2 or above; HSTS is enforced.
• All data at rest is encrypted with AES-256, including database, file storage, and backups.
• Passwords are hashed with bcrypt at a work factor of 12 or higher; plaintext passwords are never stored or logged.
• PII is masked in application logs; emails and names appear only as hashed values.

Infrastructure

Depentra runs on Cloudflare's global edge network with Supabase-managed PostgreSQL, storage, and authentication. Backups are taken continuously with point-in-time recovery, and disaster recovery is tested twice a year. Production access requires hardware-key MFA and is logged and reviewed.

Access controls

• Role-based access control with Viewer, Contributor, Editor, Programme Manager, and Administrator roles.
• Row-level security enforced at the database layer for every query.
• Two-factor authentication available to all users; SAML 2.0 SSO and SCIM provisioning on Enterprise.
• Session management with revocation, login event history, and configurable token expiry.
• Failed logins are rate-limited to 5 attempts per 15 minutes per IP.

Testing and monitoring

Independent penetration tests run twice a year, with findings tracked to closure. Automated dependency and container scanning runs on every build. All file uploads are scanned for malware before being made available. Content Security Policy headers restrict script execution across the application.

Compliance

• SOC 2 Type II certified; report available under NDA.
• GDPR compliant, including data export and erasure rights.
• PCI DSS scope minimised: all payment card data is handled exclusively by Stripe.

Vulnerability disclosure

We welcome good-faith security research. Report vulnerabilities to security@depentra.com with steps to reproduce. We acknowledge within 2 business days, keep you informed through remediation, and do not pursue legal action against researchers acting in good faith within the Acceptable Use Policy. Please do not access other customers' data or degrade the service.