Hand this page to your CISO.
How Farrenio authenticates, authorises, encrypts, audits, and disposes of your data, stated as controls you can verify rather than claims you take on trust.
TOTP MFA 92-perm RBAC Encrypted at rest 180–365d audit GDPR-aware SOC2-aligned
Authentication & MFA
Strong sign-in enforced by default, recoverable but never bypassable.
- JWT bearer tokens (HS256, 24 h expiry). A per-user `tokens_revoked_at` cut-off invalidates every outstanding token on logout-all or password change, leaving no server-side session to hijack.
- TOTP MFA (RFC 6238) is supported per account and gates API-token reveal; sign-ins to the code-server gate must clear the TOTP challenge before a shell is issued.
- Google OAuth is offered as an alternative path, but every first-time Google identity is held `pending`, with no access until a platform owner explicitly approves it.
- Login rate-limiting (5/min) at the auth route, plus a fail2ban jail that auto-blocks brute-force IPs on /api/auth/*.
- Account-level lockout on the API-token PIN. It binds to the account, so it survives IP rotation.
Role-based access control
92 granular permissions across 8 roles, enforced at the API rather than hidden in the UI.
- Eight built-in roles: platform_owner, admin, customer_admin, customer, technician and service_desk, plus contractor (own timesheets and payments only) and a marketing-only support_agent role scoped to Aria chat operators.
- 92 individually-toggleable permissions spanning navigation, SAP transaction tabs, and privileged actions; per-role overrides are editable from the Role Management UI.
- Every privileged route sits behind a server-side Depends() RBAC guard. Front-end gating is cosmetic; the boundary refuses any request beyond the caller's grant and records it as a denied attempt.
Encryption at rest & in transit
Sensitive fields are sealed at rest with Fernet; every byte in transit rides TLS 1.3.
- SSH credentials, SMTP passwords, OAuth refresh tokens, and API tokens are all Fernet-encrypted at rest; SSH credentials use a dedicated SSH_ENCRYPTION_KEY that the platform refuses to boot without.
- Agent-side credentials (HANA and RFC passwords in config.yaml) are Fernet-wrapped behind an `enc:` prefix under a key issued per agent. That key is stored only in wrapped form, itself encrypted under the platform key, and is released to the host it belongs to.
- Every request terminates TLS 1.3 at a Caddy edge, with automatic Let's Encrypt renewal and HSTS preloaded.
- No customer credential ever reaches the logs; decrypted plaintext is rendered only client-side, and only after an MFA-gated reveal.
Audit trail & retention
Every privileged action recorded and attributed, retained up to 365 days, queryable from the UI.
- Every login, role change, token reveal, runbook execution, sapcontrol command, and configuration change is appended to db.audit_logs with actor id, source IP, and outcome.
- Retention is 365 days for authentication and authorization events, 180 days for everything else; SOC2 reviewers export any date range as CSV / PDF.
- Auth attempts stream live to the Audit Logs page as Security Pulse, where a spike in failed logins raises an automatic alert.
Network & transport
No inbound to your SAP hosts, ever.
- The collector agent is outbound-only. It polls Farrenio over HTTPS for its config and pushes metrics the same way. No inbound port, no new firewall rule, nothing listening on your SAP hosts.
- Each agent carries a bearer token bound to its customer_id, and any token is revocable on the spot from the Collector Management UI.
- Live-dashboard WebSocket fan-out reuses the same JWT, so it shares the origin, TLS and audit trail with no second credential to manage.
Data residency & privacy
EU-hosted, GDPR-aware, no third-party trackers.
- MongoDB runs on the same VPS as the application, reachable only across a private Docker network with no host port exposed.
- Visitor analytics is opt-in: events fire only after the visitor accepts the Analytics cookie category, and source IPs are stored truncated to /24.
- Consent-free pageview counts use a daily-rotating sha256 bucket that can't be reversed to a visitor and resets at midnight.
- No third-party tracking on the marketing site. No DoubleClick, no Facebook pixel, no LinkedIn Insight tag.
- Right-to-erasure: the platform owner can delete chat sessions and demo requests on request, and analytics events expire automatically after 180 days.
Vulnerability management
Zero known CVEs in the backend per pip-audit; weekly Dependabot.
- Continuous backend dependency passes hold pip-audit at zero high-severity findings; recent waves patched FastAPI, starlette, cryptography, pillow, pymongo, requests, PyJWT, paramiko, ecdsa, aiohttp.
- Vulnerable frontend transitives are pinned out via yarn `resolutions`: nth-check, serialize-javascript, underscore.
- Dependabot runs weekly, batched per ecosystem; the few risk-accepted exceptions (paramiko #45, ecdsa #4) are dismissed with written justification, not ignored.
- One item remains tracked in the open: MongoDB DB-level auth. Today the database is reachable only across the isolated Docker network, with credentialed DB auth planned as defence-in-depth. The agent-ingest routes, /discoveries/report included, are now gated by a per-agent bearer token.
Compliance & alignment
SOC2-aligned audit posture, GDPR controller, DPA on request.
- SOC2-aligned audit retention of up to 365 days, append-only and immutable, exportable on demand.
- The GDPR data controller is Farrenio SRL, RO44493130. A DPA template is ready, so ask and we return a signed copy.
- The Privacy Policy at /privacy sets out lawful bases, retention windows, and every sub-processor (SMTP, ip-api.com geo, Google OAuth, and Anthropic / OpenAI / Gemini for AI features).
Questions a checklist can't cover?
Send us a note. The DPA, current sub-processor list, penetration-test summaries and live security reviews are all available on request.