Security & Compliance

Encryption at Rest

All data is stored with AES-256 encryption in our databases and backup systems.

• • AES-256-GCM: Industry-standard encryption algorithm
• • Encrypted database: MongoDB with encrypted volumes
• • Encrypted backups: Daily automated backups with encrypted storage
• • Key management: Secure key storage (secrets management)

Encryption in Transit

All network communication is protected with TLS 1.3 encryption.

• • TLS 1.3: Latest TLS protocol version
• • HTTPS: All web traffic over HTTPS only
• • WebSocket: Encrypted real-time connections (WSS)
• • Third-party APIs: Stripe (all TLS 1.2+)

Password Protection

Passwords are stored using bcrypt hashing algorithm (12 rounds).

• • Bcrypt (12 rounds): Secure hashing with salt
• • Password requirements: Min. 8 chars, upper/lower, number, special char
• • Strength validation: Real-time password strength indicator

Role-Based Access Control (RBAC)

Granular permission management based on roles and permissions.

• • Roles: OWNER, ADMIN, MANAGER, MEMBER, VIEWER
• • Permissions: Granular permissions per resource (projects, tasks, time entries, reports, billing)
• • Workspace-level permissions: Each workspace with separate permissions

Two-Factor Authentication (2FA)

Optional 2FA available on all tiers (TOTP-based).

• • TOTP (RFC 6238): Google Authenticator, Authy, 1Password compatible
• • Backup codes: 10 one-time recovery codes
• • Enforced 2FA: ENTERPRISE tier option

Session Management

Secure session management with JWT tokens and device tracking.

• • JWT tokens: 7-day validity
• • Device tracking: List and terminate active sessions
• • Automatic logout: After inactivity period
• • Login history: Track successful and failed login attempts

SSO & SAML (ENTERPRISE)

Single Sign-On integration for ENTERPRISE tier customers.

• • SAML 2.0: Compatible with Okta, Azure AD, Google Workspace
• • LDAP: Active Directory integration
• • Centralized access: Single login for multiple applications

IP Allowlisting (ENTERPRISE)

Restrict access to specific IP addresses.

• • Access only from whitelisted IP addresses
• • CIDR notation support
• • Workspace-level IP restrictions

Hosting & Data Center

Hosted on Hetzner Online GmbH dedicated servers (Germany, EU).

• • Location: Germany (EU), GDPR compliant
• • ISO 27001: Hetzner datacenter certified
• • Physical security: 24/7 monitoring, biometric access
• • Power supply: Redundant UPS and generators

Backups

Daily automated backups with encrypted, geo-redundant S3 storage and 90-day retention.

• • Frequency: Daily full backup (2:00 AM CET)
• • Retention: 90 days (ENTERPRISE: 1 year)
• • Encryption: AES-256-GCM symmetric encryption before upload
• • Storage: Wasabi S3 (eu-central-2, Frankfurt) — GDPR-compliant, EU data center
• • Integrity: SHA-256 checksum for every backup file
• • Recovery time: RTO < 4 hours, RPO < 24 hours

Server Hardening

Regular security updates and server hardening.

• • OS updates: Weekly automated security patches
• • Firewall: Only necessary ports open (443, 80)
• • Fail2ban: Brute-force protection
• • Minimal surface: Only necessary services running

Network Security

Multi-layer network protection with firewalls and DDoS mitigation.

• • DDoS protection: Hetzner automatic DDoS mitigation
• • Rate limiting: API rate limits on all endpoints
• • WAF: Web Application Firewall (Cloudflare Pro)

Security Headers

HTTP security headers in all responses (Helmet middleware).

• • Strict-Transport-Security (HSTS): Force HTTPS for 1 year
• • X-Content-Type-Options: Prevent MIME sniffing
• • X-Frame-Options: Clickjacking protection
• • Content-Security-Policy (CSP): XSS protection, resource loading rules
• • X-XSS-Protection: Enable browser XSS filter

Input Validation

Strict input validation on all API endpoints.

• • Joi validation: Schema-based validation
• • Sanitization: HTML/SQL injection protection
• • Type checking: TypeScript type safety

Audit Logging

Detailed audit logs for all critical operations.

• • Login/logout events (successful and failed)
• • Data modifications (create, update, delete)
• • Role changes
• • Security events (2FA, password change)
• • Retention: 2 years (ENTERPRISE), 90 days (FREE/PRO)

Dependency Scanning

Regular npm audit and dependency updates.

• • npm audit: Weekly automated security audit
• • Dependabot: Automated PRs for security updates
• • Critical CVEs fixed immediately (< 24 hours)

Incident Response Team

• • Availability: 24/7 on-call team
• • Response time: < 1 hour (critical incidents)
• • Escalation: Automatic escalation matrix

Incident Reporting Process

1. Detection: Automated monitoring + user report
2. Categorization: Severity assessment (S0-S4)
3. Containment: Incident containment and mitigation
4. Notification: Notify affected parties (< 24 hours)
5. Investigation: Root cause analysis
6. Recovery: Service restoration
7. Post-mortem: Documentation and lessons learned

Communication Channels

• • Security incidents: security@cadensa.io
• • Data breaches: privacy@cadensa.io
• • Status page: status.cadensa.io

Reporting Process

1. Send a detailed report to security@cadensa.io
2. Wait for acknowledgment (< 24 hours)
3. Collaborate during the fix
4. Coordinate public disclosure

Out of Scope

• • Social engineering attacks
• • Physical attacks
• • DDoS
• • Spam or phishing

Fix SLAs

• • Critical: 24 hours
• • High: 7 days
• • Medium: 30 days
• • Low: 90 days

Bug Bounty Program

Roadmap: 2026 Q3 (on HackerOne or Bugcrowd platform)