In development
Controls we can show you
These are the controls in the code today, not a list of certificates we have not earned.
Numbers in the product
Defaults from the running policy, not a brochure.
- Idle timeout default
- 15 minIdle timeout defaultA session older than this is signed out
- Minimum password length
- 12Minimum password lengthUppercase, lowercase, digit, and symbol required
- Failed sign-ins before lockout
- 5Failed sign-ins before lockoutThe lock lasts 15 minutes
- HSTS max-age
- 1 yearHSTS max-ageEvery response sends Strict-Transport-Security
What each control does
Named after the file that implements it.
| Control | What it does |
|---|---|
| Content-Security-Policy | Scripts and frames stay on this origin, plus Turnstile on /contact |
| Two-step verification | An authenticator app code after the password |
| Audit log | Who changed what, and when |
| Production data residency | Canada Central, with Canada East as the pair |
Security questions
Do you have SOC 2?
No. We do not claim a report we have not earned.
Is production data on Cloudflare?
No. Production data stays in Canada. Cloudflare is edge only, or absent.
Can a role skip two-step verification?
Some roles must turn it on before they open the admin space.
Where is the audit log?
In the product. Administrators can read who changed what, and when.
Ask a security question
Write in English or French. We answer both.