Security
Trellis holds other companies' salaries, contracts and review notes in the same tables as yours. So the boundary cannot be good intentions — it has to be the shape of the database.
Held by the database
- The boundary between companies
- Every row a company owns carries its owner, and the filtering lives in one layer per service rather than scattered through request handlers. Postgres row-level security sits underneath as the backstop: a filter somebody forgot returns nothing, rather than another company's rows.
- Entitlement, per app
- Trellis decides which apps your company may open, and who inside it may open them. Those are two different questions, and a seat-counted plan needs both answered yes.
- An audit trail that is yours
- Who signed in, who changed whose role, which key was minted. Your company can read its own trail and nobody else's.
- UU PDP No. 27/2022
- We become a processor of another company's employees' personal data, and the obligations are built in rather than bolted on: a stated retention policy, export and deletion on request, and a breach-notification path.
- Passwords are measured by length, not composition
- Twelve characters minimum, and no “must contain a symbol” rule. Composition rules push people towards Passw0rd! and away from a passphrase, which is the opposite of the aim.
- Sign-up is rate limited
- Five registrations per IP address per hour. Registration is the only privileged call on this platform that runs with nobody signed in behind it, which makes it the one most worth being suspicious of.
What is not there yet
Written down because a security page containing only good news does not deserve to be believed. Not running today: per-company point-in-time restore proven by an actual restore, and encryption of the sensitive columns with per-company key separation. Both are being built and neither is something we can claim.