Security policy
This policy describes how OBMr is protected. Items marked as planned are not in place yet.
Access to customer data
- Each organization is sealed off by the database. Every record carries its organization, and the database checks every request against the signed-in person's membership and role before returning or changing anything. Our application code cannot override this; it runs under a database role that is not allowed to bypass these rules.
- Least privilege by role. Personnel records are visible only to the person, HR and administrators. Supervisors see the people they supervise. Only administrators see the activity log.
- Records point only within their own organization. The database refuses a record that links to another organization's data.
Accounts
- Accounts are created only by invitation. There is no public sign-up.
- Passwords are at least 12 characters and stored as salted scrypt hashes.
- Two-step sign-in with an authenticator app is required for administrators and HR. Codes cannot be reused.
- After 5 failed sign-ins for an email, or 20 from one network address, within 15 minutes, further attempts are refused for 15 minutes. Five wrong codes end the session.
- Sessions end after 12 hours, or 30 minutes without activity. Users can sign out of every device at once.
Data protection
- Every connection uses HTTPS, with HSTS.
- Two-step secrets are encrypted with AES-256-GCM using a key held only in the hosting environment's secret settings.
- Session and invitation tokens are stored only as SHA-256 hashes.
- Database encryption at rest is provided by Netlify, Inc. (Netlify Database). encryption at rest details.
- Secrets are never stored in source code.
- Each deploy preview runs on its own copy of the database, which includes production data. Previews are open only to our team through single sign-on, and the app still requires every person to sign in.
Logging
- Changes to people, memberships, supervision, pinpoints, observations, phases and interventions are recorded with who made them and when. Personnel record changes record which fields changed, not their values.
- Every view of a personnel record is recorded.
- The activity log cannot be edited or deleted by anyone through the app, and the database refuses changes to it except the scheduled retention purge and erasure described in the data retention schedule.
Application security
- The browser must send a custom header, and the request must come from our own site, for any change. Cookies are HttpOnly and SameSite=Strict.
- Pages run under a strict content security policy and cannot be framed by other sites.
- Every input is validated on the server. Errors never reveal database details.
- Automated tests cover tenant isolation, role boundaries, sign-in protections and the activity log on every change. Each protection has been checked by removing it and confirming a test fails.
People
- Staff with production access are named, use two-step sign-in on every system that offers it, and lose access on the day they leave.
- Staff sign a confidentiality undertaking before access.
- Customer data is accessed only to provide support the customer asked for, investigate an incident, or meet a legal obligation.
Vendors
Subprocessors are listed on the subprocessors page. Before adding one, we review its security, data processing terms and hosting region.
Planned
- Independent penetration test before the first paid customer.
- Hash-chained activity log with an external copy.
- Alerts on unusual administrative access.
- Error and uptime monitoring.
Reporting a vulnerability
Email security@obmr.app. We will acknowledge within 2 business days, keep you updated, and not take legal action against good-faith research that avoids privacy harm and service disruption.