Security
What Aquaindy does to protect agency and client data, stated plainly. Nothing here is a certification; an external review is on the release list.
Tenant isolation at three layers
Every route checks workspace membership, every query carries the workspace id, and foreign keys in the database refuse links across workspaces.
Permissions, not job titles
Six roles map to explicit permissions. Finance data has its own permissions; client guests hold a single portal permission and reach only granted projects.
Accounts and sessions
Passwords are hashed with argon2id, sessions are opaque hashed tokens in secure, same-site cookies, verification and reset links are single-use, and sign-in does not reveal whether an address exists. People can add passkeys or an authenticator app as a second factor, with recovery codes, and sign out other devices.
Files
Uploads are checked for size, type and content, scanned for malware when a scanner is configured, stored in a private bucket and served through signed links that expire in minutes. Deliverable files are fingerprinted before an approval counts.
Audit trail
Security-relevant changes and financial overrides are written to an audit log; approval decisions are append-only at the database level.
Operations
Rate limiting, request origin checks, idempotency keys on commands, retries with dead-letter inspection for background work, and metrics behind an operator token.
Browser and network protections
Every page carries a Content Security Policy that lets only its own scripts run and limits which services the browser may reach. Requests the server makes to other services refuse internal network addresses.
Your data, on request
People can export their personal data and delete their account. Owners can export a workspace and delete it after a 30-day grace period.
Known gaps, on the release list
- An external penetration test and accessibility audit.
- Backups with a rehearsed restore on the production host.
- Malware scanning against a production scanner (tested against a simulator so far).
Reporting a vulnerability
Report a suspected vulnerability to support@aquaindy.com, with the steps to reproduce it. Please give us reasonable time to fix it before disclosing it.