E · Security
Reads first. Acts only with your permission.
A connection reads. Writing to a system is a separate permission a person gives for that connection, and it is refused until then. Each organisation's records are kept apart by the database itself, keys to your systems are sealed, and card numbers are removed before anything is stored. Each of these has an automated test.
Each organisation on its own
In the database
Every table that holds an organisation's records forces row-level security: the database returns only the signed-in organisation's rows.
Tested on every table
A test reads every table as one organisation and finds none of another organisation's rows.
Admins of their own
An organisation's admin manages its own people and no one else's.
FourWinds sales staff
FourWinds' sales staff set an organisation up for its admin and do not become members of it.
Keys to your systems
Sealed
Each key or sign-in token is sealed with AES-256-GCM and bound to the one connection it belongs to. Moved anywhere else, it does not open.
Rotated
The sealing key can be changed. Values sealed under the old key still open, and are resealed under the new one.
Read first
A connection reads. Writing to a system is a separate permission, given for that connection by a person, and refused until then.
The narrowest key
Where a vendor offers restricted keys, only a restricted key is accepted. A Stripe secret key is refused.
Disconnected for good
Disconnecting revokes access at the vendor and deletes the stored credentials.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyCard numbers kept out
Removed at the door
A card number typed into any field of a form is replaced before anything is stored. The record keeps which field it was in, and the check fails.
The last four digits
Payments are kept with the provider's reference and the card's last four digits.
Checked on every payment
Each payment event is read for a full card number.
What comes in, and what goes out
Signed requests
Your website and other systems sign what they send. A bad or missing signature, an old timestamp or an oversized body is refused before anything in it is read.
Forgeries noticed
Repeated forged requests raise an alert. A new secret needs an approver, and the old one then stops working.
Your shop's address checked
Before an organisation's own shop is called, its address is looked up and must be a public internet address, over https. The call goes to exactly the address checked.
No repeated writes
A read that fails is tried again. A write that may have landed is not sent twice.
Want this on your own systems? It starts with an audit of how your business really runs.
Book an auditAccess to your systems
Admin access checked
Each grant of admin or owner access on a connected system is checked: approved by a named person, with two-step sign-in on.
Every change recorded
Each change of access is an event on the record, with its check and its fingerprint.
Every night
Each organisation is copied every night, sealed with the deployment's key, and kept in a private store apart from the database.
Opened before it counts
Each copy is read back and opened before the night counts, and a copy restores into an empty database row for row.
A year of copies
The last 35 nights are kept, and the first night of each month for a year.
Read, and nothing else
The backup reads through a role that sees every organisation and can change nothing. Sign-in sessions and password hashes are left out of it.
Want this on your own systems? It starts with an audit of how your business really runs.
Book an auditThe web app
Everything from its own address
Its pages load scripts, styles, fonts and images from its own address and refuse to be framed by another site.
These pages
The public pages set no cookies and load no tracking.
Start here
See it on a business of your own.
Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.