Security baseline

This is what every blueprint answers by default. A blueprint references this document and adds only what is specific to it.

What is covered by default

• Role-based access and separation between client organisations. Users see what their role allows, and one client’s data is never reachable from another client’s context.
• Secure authentication and account administration. Account creation, password and session handling, deactivation of leavers, and an administrator who can act on all of it.
• Audit trail of significant workflow actions. Who did what and when, on the actions that carry operational or commercial weight — not an undifferentiated log of everything.
• Backup, monitoring and incident-response expectations. These are delivered through the Managed Hosting blueprint. They are not assumed to exist: if that blueprint is not part of the scope, say who is responsible instead.
• GDPR-aware data handling and retention. Personal data, its lawful basis, its retention period and its deletion path are decisions taken per implementation, documented for that implementation.
• Documentation of integrations, workflow rules and ownership. What connects to what, what the rules are, and who owns each part after handover.

What is decided per implementation

Retention periods, data-residency requirements, encryption expectations beyond the defaults, single sign-on, and any client-specific security policy. These are captured during the workflow assessment and confirmed in the solution blueprint. Anything still undecided is marked [TBD] rather than assumed.

What we do not claim

We hold no compliance certifications, and we do not imply otherwise. What this baseline offers is a solution designed to support your organisation’s security, access-control, retention and GDPR obligations — not a certification of them.