Authentication & SSO

• Amazon Cognito user pools for primary authentication.

• Optional Google identity federation (OIDC).

• Multi‑factor authentication (MFA) supported via Cognito (TOTP and SMS, if enabled).

• Session tokens protected in transit with TLS; short‑lived tokens, refresh via Cognito.

Authorization & Access Control

• Policy enforcement with Casbin (role/attribute‑based).

• Least‑privilege access for internal services and IAM roles.

• Scoped access to projects, evidence, and exports by organization and user role.

Data Storage & Encryption

• Files stored in Amazon S3 with server‑side encryption (SSE‑S3 or SSE‑KMS).

• Database hosted on MongoDB Atlas with encryption at rest enabled.

• All data in transit protected with TLS 1.2+.

Logging & Audit Trails

• Application logs and key events captured for troubleshooting and auditability.

• Evidence actions (upload/download/delete) are recorded with actor and timestamp.

Backups & Availability

• S3 durability for stored objects; versioning can be enabled for protected buckets.

• MongoDB Atlas backups enabled per cluster configuration.

Data Retention & Deletion

• We retain customer data only for as long as needed to provide the service or as required by law.

• Deletion requests can be initiated by contacting support; media and database records are removed from active systems following request validation.

Subprocessors

We use trusted infrastructure providers to deliver the service:

• Amazon Web Services (hosting, storage, identity).

• MongoDB Atlas (database hosting).